xmrig | ef94745fbf9156e36ae678ea8f16501e1b4364ed9a2f1e2cbfadea235b0a789d

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3ba4283a899e497e6b35fe46a2554e60.exe
Size

1.8MB
MD5

3ba4283a899e497e6b35fe46a2554e60
SHA1

20be20183ae903b1b0f606f5ba80d0561e68c320
SHA256

ef94745fbf9156e36ae678ea8f16501e1b4364ed9a2f1e2cbfadea235b0a789d
SHA512

e88c9d1d02e4a8541faeb5f53ef327296d80cc6edc60c4f799b951be25682c4e4c62333d0021e0a12594dfe208f85c36c0060cbed76ba1c11411f929a5a6fd5b
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9Jtg:Lz071uv4BPMkibTIA5LDGTUXaDmUw

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/3784-209-0x00007FF7850F0000-0x00007FF7854E2000-memory.dmp	xmrig
behavioral2/memory/396-229-0x00007FF7AB0C0000-0x00007FF7AB4B2000-memory.dmp	xmrig
behavioral2/memory/2472-409-0x00007FF6C66C0000-0x00007FF6C6AB2000-memory.dmp	xmrig
behavioral2/memory/1880-497-0x00007FF6838B0000-0x00007FF683CA2000-memory.dmp	xmrig
behavioral2/memory/1088-571-0x00007FF69AAA0000-0x00007FF69AE92000-memory.dmp	xmrig
behavioral2/memory/4232-577-0x00007FF782630000-0x00007FF782A22000-memory.dmp	xmrig
behavioral2/memory/4928-582-0x00007FF6C7F20000-0x00007FF6C8312000-memory.dmp	xmrig
behavioral2/memory/4424-1725-0x00007FF7FBD30000-0x00007FF7FC122000-memory.dmp	xmrig
behavioral2/memory/4964-581-0x00007FF65A7F0000-0x00007FF65ABE2000-memory.dmp	xmrig
behavioral2/memory/2348-580-0x00007FF7582D0000-0x00007FF7586C2000-memory.dmp	xmrig
behavioral2/memory/2204-579-0x00007FF7F6B30000-0x00007FF7F6F22000-memory.dmp	xmrig
behavioral2/memory/1328-578-0x00007FF73C500000-0x00007FF73C8F2000-memory.dmp	xmrig
behavioral2/memory/1200-576-0x00007FF63E4A0000-0x00007FF63E892000-memory.dmp	xmrig
behavioral2/memory/2180-575-0x00007FF75E280000-0x00007FF75E672000-memory.dmp	xmrig
behavioral2/memory/3452-574-0x00007FF687670000-0x00007FF687A62000-memory.dmp	xmrig
behavioral2/memory/4528-573-0x00007FF64ECC0000-0x00007FF64F0B2000-memory.dmp	xmrig
behavioral2/memory/2868-572-0x00007FF667220000-0x00007FF667612000-memory.dmp	xmrig
behavioral2/memory/5028-570-0x00007FF7D0700000-0x00007FF7D0AF2000-memory.dmp	xmrig
behavioral2/memory/980-569-0x00007FF6A54C0000-0x00007FF6A58B2000-memory.dmp	xmrig
behavioral2/memory/1240-496-0x00007FF66F850000-0x00007FF66FC42000-memory.dmp	xmrig
behavioral2/memory/3136-336-0x00007FF73C4C0000-0x00007FF73C8B2000-memory.dmp	xmrig
behavioral2/memory/3032-284-0x00007FF650A00000-0x00007FF650DF2000-memory.dmp	xmrig
behavioral2/memory/2220-283-0x00007FF64FE00000-0x00007FF6501F2000-memory.dmp	xmrig
behavioral2/memory/3476-166-0x00007FF6AF7E0000-0x00007FF6AFBD2000-memory.dmp	xmrig
behavioral2/memory/1428-169-0x00007FF711170000-0x00007FF711562000-memory.dmp	xmrig
behavioral2/memory/3476-2144-0x00007FF6AF7E0000-0x00007FF6AFBD2000-memory.dmp	xmrig
behavioral2/memory/2348-2146-0x00007FF7582D0000-0x00007FF7586C2000-memory.dmp	xmrig
behavioral2/memory/1428-2148-0x00007FF711170000-0x00007FF711562000-memory.dmp	xmrig
behavioral2/memory/3784-2150-0x00007FF7850F0000-0x00007FF7854E2000-memory.dmp	xmrig
behavioral2/memory/980-2152-0x00007FF6A54C0000-0x00007FF6A58B2000-memory.dmp	xmrig
behavioral2/memory/5028-2156-0x00007FF7D0700000-0x00007FF7D0AF2000-memory.dmp	xmrig
behavioral2/memory/396-2155-0x00007FF7AB0C0000-0x00007FF7AB4B2000-memory.dmp	xmrig
behavioral2/memory/2220-2158-0x00007FF64FE00000-0x00007FF6501F2000-memory.dmp	xmrig
behavioral2/memory/3032-2162-0x00007FF650A00000-0x00007FF650DF2000-memory.dmp	xmrig
behavioral2/memory/2472-2161-0x00007FF6C66C0000-0x00007FF6C6AB2000-memory.dmp	xmrig
behavioral2/memory/1880-2164-0x00007FF6838B0000-0x00007FF683CA2000-memory.dmp	xmrig
behavioral2/memory/4232-2166-0x00007FF782630000-0x00007FF782A22000-memory.dmp	xmrig
behavioral2/memory/4964-2169-0x00007FF65A7F0000-0x00007FF65ABE2000-memory.dmp	xmrig
behavioral2/memory/1328-2171-0x00007FF73C500000-0x00007FF73C8F2000-memory.dmp	xmrig
behavioral2/memory/2180-2188-0x00007FF75E280000-0x00007FF75E672000-memory.dmp	xmrig
behavioral2/memory/4528-2186-0x00007FF64ECC0000-0x00007FF64F0B2000-memory.dmp	xmrig
behavioral2/memory/1088-2183-0x00007FF69AAA0000-0x00007FF69AE92000-memory.dmp	xmrig
behavioral2/memory/2204-2181-0x00007FF7F6B30000-0x00007FF7F6F22000-memory.dmp	xmrig
behavioral2/memory/2868-2179-0x00007FF667220000-0x00007FF667612000-memory.dmp	xmrig
behavioral2/memory/1240-2173-0x00007FF66F850000-0x00007FF66FC42000-memory.dmp	xmrig
behavioral2/memory/3136-2178-0x00007FF73C4C0000-0x00007FF73C8B2000-memory.dmp	xmrig
behavioral2/memory/3452-2175-0x00007FF687670000-0x00007FF687A62000-memory.dmp	xmrig
behavioral2/memory/1200-2197-0x00007FF63E4A0000-0x00007FF63E892000-memory.dmp	xmrig
behavioral2/memory/4928-2192-0x00007FF6C7F20000-0x00007FF6C8312000-memory.dmp	xmrig

Blocklisted process makes network request 8 IoCs

flow	pid	Process
3	4660	powershell.exe
5	4660	powershell.exe
22	4660	powershell.exe
23	4660	powershell.exe
25	4660	powershell.exe
27	4660	powershell.exe
28	4660	powershell.exe
29	4660	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4660	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2348	bgAEfEc.exe
3476	zOHLqme.exe
1428	xgAdWKD.exe
3784	KKWOZVr.exe
396	aqCBsor.exe
2220	ZBdhTBi.exe
3032	WWjJFCf.exe
4964	diVcgIt.exe
3136	JhmosBp.exe
2472	lTIqove.exe
1240	SWfXFde.exe
1880	nxOxsqw.exe
980	WDWSjBR.exe
5028	FyxHqqq.exe
1088	Ldnioew.exe
2868	HitQoKe.exe
4528	TNvQrtF.exe
3452	dTxAbKn.exe
2180	OTfmhZt.exe
1200	AHvQsHe.exe
4928	LwGftcN.exe
4232	UWluzLx.exe
1328	OUYKgXF.exe
2204	YmyndXD.exe
3480	gBbNyHB.exe
5036	BarhRzl.exe
4980	BaAuSaC.exe
5088	cKGbKwh.exe
216	syhxDsf.exe
2840	hhGKFuc.exe
1072	zqFywgA.exe
4056	fNzUeCV.exe
1624	fHRiCFG.exe
2888	SuiQaeM.exe
2200	NuEUSxV.exe
900	diWJRJr.exe
208	hIfBcXD.exe
3824	oKACRbX.exe
3944	TOBziva.exe
3884	cGCBExH.exe
864	SvcmIFc.exe
2164	JXsziOL.exe
2408	hZihlQO.exe
1528	bxjTrco.exe
3796	zZEezcS.exe
2092	kCKrPHN.exe
2724	HAnsoNX.exe
2340	mOEYiXt.exe
3000	nndECZL.exe
2492	CJYEJxH.exe
4024	EZPykaY.exe
3552	ovtdGht.exe
3352	YnnoFOE.exe
3420	NBsfAdv.exe
1788	xJAELQu.exe
3440	GppogsE.exe
4408	KgyGcMr.exe
4912	EKVyjhd.exe
3984	zYPAvRy.exe
3988	TFCcNwu.exe
4436	BNGDwDM.exe
624	qSZOYUo.exe
1848	hfwuScj.exe
2152	DEhobQc.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4424-0-0x00007FF7FBD30000-0x00007FF7FC122000-memory.dmp	upx
behavioral2/files/0x0007000000023436-6.dat	upx
behavioral2/files/0x0007000000023438-20.dat	upx
behavioral2/files/0x0007000000023441-69.dat	upx
behavioral2/files/0x000700000002344b-119.dat	upx
behavioral2/memory/3784-209-0x00007FF7850F0000-0x00007FF7854E2000-memory.dmp	upx
behavioral2/memory/396-229-0x00007FF7AB0C0000-0x00007FF7AB4B2000-memory.dmp	upx
behavioral2/memory/2472-409-0x00007FF6C66C0000-0x00007FF6C6AB2000-memory.dmp	upx
behavioral2/memory/1880-497-0x00007FF6838B0000-0x00007FF683CA2000-memory.dmp	upx
behavioral2/memory/1088-571-0x00007FF69AAA0000-0x00007FF69AE92000-memory.dmp	upx
behavioral2/memory/4232-577-0x00007FF782630000-0x00007FF782A22000-memory.dmp	upx
behavioral2/memory/4928-582-0x00007FF6C7F20000-0x00007FF6C8312000-memory.dmp	upx
behavioral2/memory/4424-1725-0x00007FF7FBD30000-0x00007FF7FC122000-memory.dmp	upx
behavioral2/memory/4964-581-0x00007FF65A7F0000-0x00007FF65ABE2000-memory.dmp	upx
behavioral2/memory/2348-580-0x00007FF7582D0000-0x00007FF7586C2000-memory.dmp	upx
behavioral2/memory/2204-579-0x00007FF7F6B30000-0x00007FF7F6F22000-memory.dmp	upx
behavioral2/memory/1328-578-0x00007FF73C500000-0x00007FF73C8F2000-memory.dmp	upx
behavioral2/memory/1200-576-0x00007FF63E4A0000-0x00007FF63E892000-memory.dmp	upx
behavioral2/memory/2180-575-0x00007FF75E280000-0x00007FF75E672000-memory.dmp	upx
behavioral2/memory/3452-574-0x00007FF687670000-0x00007FF687A62000-memory.dmp	upx
behavioral2/memory/4528-573-0x00007FF64ECC0000-0x00007FF64F0B2000-memory.dmp	upx
behavioral2/memory/2868-572-0x00007FF667220000-0x00007FF667612000-memory.dmp	upx
behavioral2/memory/5028-570-0x00007FF7D0700000-0x00007FF7D0AF2000-memory.dmp	upx
behavioral2/memory/980-569-0x00007FF6A54C0000-0x00007FF6A58B2000-memory.dmp	upx
behavioral2/memory/1240-496-0x00007FF66F850000-0x00007FF66FC42000-memory.dmp	upx
behavioral2/memory/3136-336-0x00007FF73C4C0000-0x00007FF73C8B2000-memory.dmp	upx
behavioral2/memory/3032-284-0x00007FF650A00000-0x00007FF650DF2000-memory.dmp	upx
behavioral2/memory/2220-283-0x00007FF64FE00000-0x00007FF6501F2000-memory.dmp	upx
behavioral2/files/0x000700000002345c-199.dat	upx
behavioral2/files/0x000700000002343c-190.dat	upx
behavioral2/files/0x000700000002344e-188.dat	upx
behavioral2/files/0x000700000002345a-187.dat	upx
behavioral2/files/0x0007000000023443-181.dat	upx
behavioral2/files/0x0007000000023459-179.dat	upx
behavioral2/files/0x0007000000023458-178.dat	upx
behavioral2/files/0x0007000000023457-174.dat	upx
behavioral2/files/0x000700000002344c-171.dat	upx
behavioral2/files/0x0007000000023456-170.dat	upx
behavioral2/memory/3476-166-0x00007FF6AF7E0000-0x00007FF6AFBD2000-memory.dmp	upx
behavioral2/files/0x0007000000023455-163.dat	upx
behavioral2/files/0x0007000000023454-162.dat	upx
behavioral2/files/0x0007000000023453-161.dat	upx
behavioral2/files/0x0007000000023449-160.dat	upx
behavioral2/files/0x0007000000023448-159.dat	upx
behavioral2/files/0x0007000000023452-158.dat	upx
behavioral2/files/0x0007000000023451-154.dat	upx
behavioral2/files/0x0007000000023450-150.dat	upx
behavioral2/files/0x0007000000023446-148.dat	upx
behavioral2/files/0x0007000000023445-145.dat	upx
behavioral2/files/0x000700000002343d-139.dat	upx
behavioral2/files/0x000700000002344f-138.dat	upx
behavioral2/files/0x0007000000023444-134.dat	upx
behavioral2/files/0x000700000002344d-127.dat	upx
behavioral2/files/0x000700000002343b-124.dat	upx
behavioral2/memory/1428-169-0x00007FF711170000-0x00007FF711562000-memory.dmp	upx
behavioral2/files/0x0007000000023440-107.dat	upx
behavioral2/files/0x0007000000023447-104.dat	upx
behavioral2/files/0x000700000002343a-99.dat	upx
behavioral2/files/0x000700000002343f-153.dat	upx
behavioral2/files/0x0007000000023439-89.dat	upx
behavioral2/files/0x0007000000023442-75.dat	upx
behavioral2/files/0x000700000002344a-116.dat	upx
behavioral2/files/0x000700000002343e-96.dat	upx
behavioral2/files/0x0007000000023437-42.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\qMHcMrH.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\ownctfY.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\MvuWBvH.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\ddNKGbP.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\ojqdohU.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\rukGpQf.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\JwsirbJ.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\MjfCoAA.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\lQynJsS.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\SuiQaeM.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\vDqcALI.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\GHGnmGy.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\utiENST.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\jtCphpD.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\SqtmlOP.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\fUeVhxQ.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\kCKrPHN.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\Thclwgj.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\AcRbDQc.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\YSPXPVQ.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\NyFnzHw.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\iypswRU.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\bNrXCxf.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\MaVgXKs.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\uOsJKmJ.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\aEUoRUK.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\fHRiCFG.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\IZvsaQi.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\bSKUtII.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\mRHpTQF.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\ICFoWJG.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\pdIRGnx.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\DxJFdCq.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\JFBiCYd.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\mFCqGFR.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\ykdBlXn.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\YLjxeTJ.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\dTxAbKn.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\wXDDJjn.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\vIyAYJu.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\sieOBOP.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\TWMECqz.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\vEVaWaa.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\fAvqMfe.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\zlfamds.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\zZEezcS.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\TDpFmJD.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\bnYOKWh.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\kPftDaj.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\ZEGHwHC.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\gLciuvC.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\AhfjFsL.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\cwqkJQj.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\YqarTLN.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\jlCIBuR.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\HQQeauQ.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\RzcRIkM.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\yUvodgs.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\muHNRGb.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\wgCPZGO.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\jyXyWZw.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\FJDWnYe.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\ccSjIPs.exe	3ba4283a899e497e6b35fe46a2554e60.exe
File created	C:\Windows\System\sHgNvST.exe	3ba4283a899e497e6b35fe46a2554e60.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4660	powershell.exe
4660	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4660	powershell.exe
Token: SeLockMemoryPrivilege	4424	3ba4283a899e497e6b35fe46a2554e60.exe
Token: SeLockMemoryPrivilege	4424	3ba4283a899e497e6b35fe46a2554e60.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 4660	4424	3ba4283a899e497e6b35fe46a2554e60.exe	83
PID 4424 wrote to memory of 4660	4424	3ba4283a899e497e6b35fe46a2554e60.exe	83
PID 4424 wrote to memory of 2348	4424	3ba4283a899e497e6b35fe46a2554e60.exe	84
PID 4424 wrote to memory of 2348	4424	3ba4283a899e497e6b35fe46a2554e60.exe	84
PID 4424 wrote to memory of 3476	4424	3ba4283a899e497e6b35fe46a2554e60.exe	85
PID 4424 wrote to memory of 3476	4424	3ba4283a899e497e6b35fe46a2554e60.exe	85
PID 4424 wrote to memory of 1428	4424	3ba4283a899e497e6b35fe46a2554e60.exe	86
PID 4424 wrote to memory of 1428	4424	3ba4283a899e497e6b35fe46a2554e60.exe	86
PID 4424 wrote to memory of 3784	4424	3ba4283a899e497e6b35fe46a2554e60.exe	87
PID 4424 wrote to memory of 3784	4424	3ba4283a899e497e6b35fe46a2554e60.exe	87
PID 4424 wrote to memory of 396	4424	3ba4283a899e497e6b35fe46a2554e60.exe	88
PID 4424 wrote to memory of 396	4424	3ba4283a899e497e6b35fe46a2554e60.exe	88
PID 4424 wrote to memory of 2220	4424	3ba4283a899e497e6b35fe46a2554e60.exe	89
PID 4424 wrote to memory of 2220	4424	3ba4283a899e497e6b35fe46a2554e60.exe	89
PID 4424 wrote to memory of 3032	4424	3ba4283a899e497e6b35fe46a2554e60.exe	90
PID 4424 wrote to memory of 3032	4424	3ba4283a899e497e6b35fe46a2554e60.exe	90
PID 4424 wrote to memory of 4964	4424	3ba4283a899e497e6b35fe46a2554e60.exe	91
PID 4424 wrote to memory of 4964	4424	3ba4283a899e497e6b35fe46a2554e60.exe	91
PID 4424 wrote to memory of 4528	4424	3ba4283a899e497e6b35fe46a2554e60.exe	92
PID 4424 wrote to memory of 4528	4424	3ba4283a899e497e6b35fe46a2554e60.exe	92
PID 4424 wrote to memory of 3136	4424	3ba4283a899e497e6b35fe46a2554e60.exe	93
PID 4424 wrote to memory of 3136	4424	3ba4283a899e497e6b35fe46a2554e60.exe	93
PID 4424 wrote to memory of 2472	4424	3ba4283a899e497e6b35fe46a2554e60.exe	94
PID 4424 wrote to memory of 2472	4424	3ba4283a899e497e6b35fe46a2554e60.exe	94
PID 4424 wrote to memory of 1240	4424	3ba4283a899e497e6b35fe46a2554e60.exe	95
PID 4424 wrote to memory of 1240	4424	3ba4283a899e497e6b35fe46a2554e60.exe	95
PID 4424 wrote to memory of 1880	4424	3ba4283a899e497e6b35fe46a2554e60.exe	96
PID 4424 wrote to memory of 1880	4424	3ba4283a899e497e6b35fe46a2554e60.exe	96
PID 4424 wrote to memory of 980	4424	3ba4283a899e497e6b35fe46a2554e60.exe	97
PID 4424 wrote to memory of 980	4424	3ba4283a899e497e6b35fe46a2554e60.exe	97
PID 4424 wrote to memory of 5028	4424	3ba4283a899e497e6b35fe46a2554e60.exe	98
PID 4424 wrote to memory of 5028	4424	3ba4283a899e497e6b35fe46a2554e60.exe	98
PID 4424 wrote to memory of 1088	4424	3ba4283a899e497e6b35fe46a2554e60.exe	99
PID 4424 wrote to memory of 1088	4424	3ba4283a899e497e6b35fe46a2554e60.exe	99
PID 4424 wrote to memory of 2868	4424	3ba4283a899e497e6b35fe46a2554e60.exe	100
PID 4424 wrote to memory of 2868	4424	3ba4283a899e497e6b35fe46a2554e60.exe	100
PID 4424 wrote to memory of 3452	4424	3ba4283a899e497e6b35fe46a2554e60.exe	101
PID 4424 wrote to memory of 3452	4424	3ba4283a899e497e6b35fe46a2554e60.exe	101
PID 4424 wrote to memory of 2180	4424	3ba4283a899e497e6b35fe46a2554e60.exe	102
PID 4424 wrote to memory of 2180	4424	3ba4283a899e497e6b35fe46a2554e60.exe	102
PID 4424 wrote to memory of 1200	4424	3ba4283a899e497e6b35fe46a2554e60.exe	103
PID 4424 wrote to memory of 1200	4424	3ba4283a899e497e6b35fe46a2554e60.exe	103
PID 4424 wrote to memory of 2840	4424	3ba4283a899e497e6b35fe46a2554e60.exe	104
PID 4424 wrote to memory of 2840	4424	3ba4283a899e497e6b35fe46a2554e60.exe	104
PID 4424 wrote to memory of 1072	4424	3ba4283a899e497e6b35fe46a2554e60.exe	105
PID 4424 wrote to memory of 1072	4424	3ba4283a899e497e6b35fe46a2554e60.exe	105
PID 4424 wrote to memory of 4928	4424	3ba4283a899e497e6b35fe46a2554e60.exe	106
PID 4424 wrote to memory of 4928	4424	3ba4283a899e497e6b35fe46a2554e60.exe	106
PID 4424 wrote to memory of 4232	4424	3ba4283a899e497e6b35fe46a2554e60.exe	107
PID 4424 wrote to memory of 4232	4424	3ba4283a899e497e6b35fe46a2554e60.exe	107
PID 4424 wrote to memory of 1328	4424	3ba4283a899e497e6b35fe46a2554e60.exe	108
PID 4424 wrote to memory of 1328	4424	3ba4283a899e497e6b35fe46a2554e60.exe	108
PID 4424 wrote to memory of 2204	4424	3ba4283a899e497e6b35fe46a2554e60.exe	109
PID 4424 wrote to memory of 2204	4424	3ba4283a899e497e6b35fe46a2554e60.exe	109
PID 4424 wrote to memory of 3480	4424	3ba4283a899e497e6b35fe46a2554e60.exe	110
PID 4424 wrote to memory of 3480	4424	3ba4283a899e497e6b35fe46a2554e60.exe	110
PID 4424 wrote to memory of 5036	4424	3ba4283a899e497e6b35fe46a2554e60.exe	111
PID 4424 wrote to memory of 5036	4424	3ba4283a899e497e6b35fe46a2554e60.exe	111
PID 4424 wrote to memory of 4980	4424	3ba4283a899e497e6b35fe46a2554e60.exe	112
PID 4424 wrote to memory of 4980	4424	3ba4283a899e497e6b35fe46a2554e60.exe	112
PID 4424 wrote to memory of 5088	4424	3ba4283a899e497e6b35fe46a2554e60.exe	113
PID 4424 wrote to memory of 5088	4424	3ba4283a899e497e6b35fe46a2554e60.exe	113
PID 4424 wrote to memory of 216	4424	3ba4283a899e497e6b35fe46a2554e60.exe	114
PID 4424 wrote to memory of 216	4424	3ba4283a899e497e6b35fe46a2554e60.exe	114

C:\Users\Admin\AppData\Local\Temp\3ba4283a899e497e6b35fe46a2554e60.exe
"C:\Users\Admin\AppData\Local\Temp\3ba4283a899e497e6b35fe46a2554e60.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4660
- C:\Windows\System\bgAEfEc.exe
  C:\Windows\System\bgAEfEc.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\zOHLqme.exe
  C:\Windows\System\zOHLqme.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\xgAdWKD.exe
  C:\Windows\System\xgAdWKD.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\KKWOZVr.exe
  C:\Windows\System\KKWOZVr.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\aqCBsor.exe
  C:\Windows\System\aqCBsor.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\ZBdhTBi.exe
  C:\Windows\System\ZBdhTBi.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\WWjJFCf.exe
  C:\Windows\System\WWjJFCf.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\diVcgIt.exe
  C:\Windows\System\diVcgIt.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\TNvQrtF.exe
  C:\Windows\System\TNvQrtF.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\JhmosBp.exe
  C:\Windows\System\JhmosBp.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\lTIqove.exe
  C:\Windows\System\lTIqove.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\SWfXFde.exe
  C:\Windows\System\SWfXFde.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\nxOxsqw.exe
  C:\Windows\System\nxOxsqw.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\WDWSjBR.exe
  C:\Windows\System\WDWSjBR.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\FyxHqqq.exe
  C:\Windows\System\FyxHqqq.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\Ldnioew.exe
  C:\Windows\System\Ldnioew.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\HitQoKe.exe
  C:\Windows\System\HitQoKe.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\dTxAbKn.exe
  C:\Windows\System\dTxAbKn.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\OTfmhZt.exe
  C:\Windows\System\OTfmhZt.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\AHvQsHe.exe
  C:\Windows\System\AHvQsHe.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\hhGKFuc.exe
  C:\Windows\System\hhGKFuc.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\zqFywgA.exe
  C:\Windows\System\zqFywgA.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\LwGftcN.exe
  C:\Windows\System\LwGftcN.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\UWluzLx.exe
  C:\Windows\System\UWluzLx.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\OUYKgXF.exe
  C:\Windows\System\OUYKgXF.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\YmyndXD.exe
  C:\Windows\System\YmyndXD.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\gBbNyHB.exe
  C:\Windows\System\gBbNyHB.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\BarhRzl.exe
  C:\Windows\System\BarhRzl.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\BaAuSaC.exe
  C:\Windows\System\BaAuSaC.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\cKGbKwh.exe
  C:\Windows\System\cKGbKwh.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\syhxDsf.exe
  C:\Windows\System\syhxDsf.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\fNzUeCV.exe
  C:\Windows\System\fNzUeCV.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\fHRiCFG.exe
  C:\Windows\System\fHRiCFG.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\SuiQaeM.exe
  C:\Windows\System\SuiQaeM.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\NuEUSxV.exe
  C:\Windows\System\NuEUSxV.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\diWJRJr.exe
  C:\Windows\System\diWJRJr.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\hIfBcXD.exe
  C:\Windows\System\hIfBcXD.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\oKACRbX.exe
  C:\Windows\System\oKACRbX.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\TOBziva.exe
  C:\Windows\System\TOBziva.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\EZPykaY.exe
  C:\Windows\System\EZPykaY.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\cGCBExH.exe
  C:\Windows\System\cGCBExH.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\SvcmIFc.exe
  C:\Windows\System\SvcmIFc.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\JXsziOL.exe
  C:\Windows\System\JXsziOL.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\hZihlQO.exe
  C:\Windows\System\hZihlQO.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\bxjTrco.exe
  C:\Windows\System\bxjTrco.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\zZEezcS.exe
  C:\Windows\System\zZEezcS.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\kCKrPHN.exe
  C:\Windows\System\kCKrPHN.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\HAnsoNX.exe
  C:\Windows\System\HAnsoNX.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\mOEYiXt.exe
  C:\Windows\System\mOEYiXt.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\nndECZL.exe
  C:\Windows\System\nndECZL.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\CJYEJxH.exe
  C:\Windows\System\CJYEJxH.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\KgyGcMr.exe
  C:\Windows\System\KgyGcMr.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\ovtdGht.exe
  C:\Windows\System\ovtdGht.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\YnnoFOE.exe
  C:\Windows\System\YnnoFOE.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\NBsfAdv.exe
  C:\Windows\System\NBsfAdv.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\xJAELQu.exe
  C:\Windows\System\xJAELQu.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\GppogsE.exe
  C:\Windows\System\GppogsE.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\EKVyjhd.exe
  C:\Windows\System\EKVyjhd.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\zYPAvRy.exe
  C:\Windows\System\zYPAvRy.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\TFCcNwu.exe
  C:\Windows\System\TFCcNwu.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\BNGDwDM.exe
  C:\Windows\System\BNGDwDM.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\qSZOYUo.exe
  C:\Windows\System\qSZOYUo.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\hfwuScj.exe
  C:\Windows\System\hfwuScj.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\DEhobQc.exe
  C:\Windows\System\DEhobQc.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\KJMAoTL.exe
  C:\Windows\System\KJMAoTL.exe
  2⤵
  PID:4596
- C:\Windows\System\wKLhqan.exe
  C:\Windows\System\wKLhqan.exe
  2⤵
  PID:3100
- C:\Windows\System\HlNigEy.exe
  C:\Windows\System\HlNigEy.exe
  2⤵
  PID:4364
- C:\Windows\System\JwsirbJ.exe
  C:\Windows\System\JwsirbJ.exe
  2⤵
  PID:2064
- C:\Windows\System\WuMvvJl.exe
  C:\Windows\System\WuMvvJl.exe
  2⤵
  PID:2256
- C:\Windows\System\gtlXuux.exe
  C:\Windows\System\gtlXuux.exe
  2⤵
  PID:1572
- C:\Windows\System\NbTEOEa.exe
  C:\Windows\System\NbTEOEa.exe
  2⤵
  PID:3592
- C:\Windows\System\TDpFmJD.exe
  C:\Windows\System\TDpFmJD.exe
  2⤵
  PID:3896
- C:\Windows\System\kPftDaj.exe
  C:\Windows\System\kPftDaj.exe
  2⤵
  PID:2992
- C:\Windows\System\laksrOy.exe
  C:\Windows\System\laksrOy.exe
  2⤵
  PID:2100
- C:\Windows\System\rgInWFe.exe
  C:\Windows\System\rgInWFe.exe
  2⤵
  PID:1196
- C:\Windows\System\NlDenbn.exe
  C:\Windows\System\NlDenbn.exe
  2⤵
  PID:3844
- C:\Windows\System\utiENST.exe
  C:\Windows\System\utiENST.exe
  2⤵
  PID:4316
- C:\Windows\System\OjNocmN.exe
  C:\Windows\System\OjNocmN.exe
  2⤵
  PID:440
- C:\Windows\System\jKTZwCZ.exe
  C:\Windows\System\jKTZwCZ.exe
  2⤵
  PID:4700
- C:\Windows\System\rZdGYAx.exe
  C:\Windows\System\rZdGYAx.exe
  2⤵
  PID:1588
- C:\Windows\System\FKTWlrA.exe
  C:\Windows\System\FKTWlrA.exe
  2⤵
  PID:1936
- C:\Windows\System\GBAGXSr.exe
  C:\Windows\System\GBAGXSr.exe
  2⤵
  PID:4116
- C:\Windows\System\GvAgJyM.exe
  C:\Windows\System\GvAgJyM.exe
  2⤵
  PID:1376
- C:\Windows\System\cSNHMkg.exe
  C:\Windows\System\cSNHMkg.exe
  2⤵
  PID:1592
- C:\Windows\System\nyugrTw.exe
  C:\Windows\System\nyugrTw.exe
  2⤵
  PID:1696
- C:\Windows\System\pdIRGnx.exe
  C:\Windows\System\pdIRGnx.exe
  2⤵
  PID:1728
- C:\Windows\System\iVpIfUH.exe
  C:\Windows\System\iVpIfUH.exe
  2⤵
  PID:5124
- C:\Windows\System\tNAItli.exe
  C:\Windows\System\tNAItli.exe
  2⤵
  PID:5144
- C:\Windows\System\muHNRGb.exe
  C:\Windows\System\muHNRGb.exe
  2⤵
  PID:5160
- C:\Windows\System\ENEoIhU.exe
  C:\Windows\System\ENEoIhU.exe
  2⤵
  PID:5196
- C:\Windows\System\jlCIBuR.exe
  C:\Windows\System\jlCIBuR.exe
  2⤵
  PID:5212
- C:\Windows\System\gqiEAXK.exe
  C:\Windows\System\gqiEAXK.exe
  2⤵
  PID:5232
- C:\Windows\System\sHgNvST.exe
  C:\Windows\System\sHgNvST.exe
  2⤵
  PID:5252
- C:\Windows\System\ljYYLMQ.exe
  C:\Windows\System\ljYYLMQ.exe
  2⤵
  PID:5272
- C:\Windows\System\pulkgWR.exe
  C:\Windows\System\pulkgWR.exe
  2⤵
  PID:5304
- C:\Windows\System\tufrJIR.exe
  C:\Windows\System\tufrJIR.exe
  2⤵
  PID:5328
- C:\Windows\System\mNkzNzh.exe
  C:\Windows\System\mNkzNzh.exe
  2⤵
  PID:5360
- C:\Windows\System\cjGgMVE.exe
  C:\Windows\System\cjGgMVE.exe
  2⤵
  PID:5432
- C:\Windows\System\okDmhvE.exe
  C:\Windows\System\okDmhvE.exe
  2⤵
  PID:5448
- C:\Windows\System\ENvWkco.exe
  C:\Windows\System\ENvWkco.exe
  2⤵
  PID:5464
- C:\Windows\System\QMygHiH.exe
  C:\Windows\System\QMygHiH.exe
  2⤵
  PID:5508
- C:\Windows\System\zDzxyat.exe
  C:\Windows\System\zDzxyat.exe
  2⤵
  PID:5524
- C:\Windows\System\rxWZmsS.exe
  C:\Windows\System\rxWZmsS.exe
  2⤵
  PID:5540
- C:\Windows\System\bEjVgay.exe
  C:\Windows\System\bEjVgay.exe
  2⤵
  PID:5564
- C:\Windows\System\XfClCZp.exe
  C:\Windows\System\XfClCZp.exe
  2⤵
  PID:5584
- C:\Windows\System\YrsyGOv.exe
  C:\Windows\System\YrsyGOv.exe
  2⤵
  PID:5604
- C:\Windows\System\TUNVMla.exe
  C:\Windows\System\TUNVMla.exe
  2⤵
  PID:5620
- C:\Windows\System\CfLgqpQ.exe
  C:\Windows\System\CfLgqpQ.exe
  2⤵
  PID:5644
- C:\Windows\System\TBLgGLD.exe
  C:\Windows\System\TBLgGLD.exe
  2⤵
  PID:5660
- C:\Windows\System\hlMXrRm.exe
  C:\Windows\System\hlMXrRm.exe
  2⤵
  PID:5680
- C:\Windows\System\zbPBdsQ.exe
  C:\Windows\System\zbPBdsQ.exe
  2⤵
  PID:5700
- C:\Windows\System\qYaEgAK.exe
  C:\Windows\System\qYaEgAK.exe
  2⤵
  PID:5732
- C:\Windows\System\nutTYia.exe
  C:\Windows\System\nutTYia.exe
  2⤵
  PID:5756
- C:\Windows\System\FKbYQEH.exe
  C:\Windows\System\FKbYQEH.exe
  2⤵
  PID:5776
- C:\Windows\System\XkoNyJW.exe
  C:\Windows\System\XkoNyJW.exe
  2⤵
  PID:5800
- C:\Windows\System\CUbPYXd.exe
  C:\Windows\System\CUbPYXd.exe
  2⤵
  PID:5816
- C:\Windows\System\BkpnzWy.exe
  C:\Windows\System\BkpnzWy.exe
  2⤵
  PID:5840
- C:\Windows\System\CDcNcSJ.exe
  C:\Windows\System\CDcNcSJ.exe
  2⤵
  PID:5860
- C:\Windows\System\BRUkAdv.exe
  C:\Windows\System\BRUkAdv.exe
  2⤵
  PID:5876
- C:\Windows\System\MGiLilX.exe
  C:\Windows\System\MGiLilX.exe
  2⤵
  PID:5892
- C:\Windows\System\kyAOnDq.exe
  C:\Windows\System\kyAOnDq.exe
  2⤵
  PID:5916
- C:\Windows\System\qllfTDg.exe
  C:\Windows\System\qllfTDg.exe
  2⤵
  PID:5940
- C:\Windows\System\FYwbuFg.exe
  C:\Windows\System\FYwbuFg.exe
  2⤵
  PID:5956
- C:\Windows\System\ErhtCkQ.exe
  C:\Windows\System\ErhtCkQ.exe
  2⤵
  PID:5972
- C:\Windows\System\UXVkHOu.exe
  C:\Windows\System\UXVkHOu.exe
  2⤵
  PID:6000
- C:\Windows\System\pqcxQjl.exe
  C:\Windows\System\pqcxQjl.exe
  2⤵
  PID:6036
- C:\Windows\System\rTjucgM.exe
  C:\Windows\System\rTjucgM.exe
  2⤵
  PID:6060
- C:\Windows\System\ZkWkiqW.exe
  C:\Windows\System\ZkWkiqW.exe
  2⤵
  PID:6080
- C:\Windows\System\InQncKd.exe
  C:\Windows\System\InQncKd.exe
  2⤵
  PID:6100
- C:\Windows\System\rKGPNoc.exe
  C:\Windows\System\rKGPNoc.exe
  2⤵
  PID:6124
- C:\Windows\System\gZTelIl.exe
  C:\Windows\System\gZTelIl.exe
  2⤵
  PID:1404
- C:\Windows\System\sknkvbI.exe
  C:\Windows\System\sknkvbI.exe
  2⤵
  PID:3120
- C:\Windows\System\QphqsEL.exe
  C:\Windows\System\QphqsEL.exe
  2⤵
  PID:4352
- C:\Windows\System\QGGjnKa.exe
  C:\Windows\System\QGGjnKa.exe
  2⤵
  PID:3024
- C:\Windows\System\Thclwgj.exe
  C:\Windows\System\Thclwgj.exe
  2⤵
  PID:768
- C:\Windows\System\XQFuzfp.exe
  C:\Windows\System\XQFuzfp.exe
  2⤵
  PID:1408
- C:\Windows\System\NiMoZhf.exe
  C:\Windows\System\NiMoZhf.exe
  2⤵
  PID:3388
- C:\Windows\System\euKABnX.exe
  C:\Windows\System\euKABnX.exe
  2⤵
  PID:3940
- C:\Windows\System\bIGdkcL.exe
  C:\Windows\System\bIGdkcL.exe
  2⤵
  PID:5296
- C:\Windows\System\IZvsaQi.exe
  C:\Windows\System\IZvsaQi.exe
  2⤵
  PID:1928
- C:\Windows\System\nvVQGXx.exe
  C:\Windows\System\nvVQGXx.exe
  2⤵
  PID:5476
- C:\Windows\System\vBZYWRj.exe
  C:\Windows\System\vBZYWRj.exe
  2⤵
  PID:3372
- C:\Windows\System\WDqNbxm.exe
  C:\Windows\System\WDqNbxm.exe
  2⤵
  PID:2020
- C:\Windows\System\ZgmbMkD.exe
  C:\Windows\System\ZgmbMkD.exe
  2⤵
  PID:5636
- C:\Windows\System\mHeSrEU.exe
  C:\Windows\System\mHeSrEU.exe
  2⤵
  PID:5140
- C:\Windows\System\cSyYaYb.exe
  C:\Windows\System\cSyYaYb.exe
  2⤵
  PID:5724
- C:\Windows\System\MjfCoAA.exe
  C:\Windows\System\MjfCoAA.exe
  2⤵
  PID:6168
- C:\Windows\System\gbxtZdR.exe
  C:\Windows\System\gbxtZdR.exe
  2⤵
  PID:6184
- C:\Windows\System\PDYSfeU.exe
  C:\Windows\System\PDYSfeU.exe
  2⤵
  PID:6208
- C:\Windows\System\YSPXPVQ.exe
  C:\Windows\System\YSPXPVQ.exe
  2⤵
  PID:6232
- C:\Windows\System\gDhISvY.exe
  C:\Windows\System\gDhISvY.exe
  2⤵
  PID:6252
- C:\Windows\System\gcihHUD.exe
  C:\Windows\System\gcihHUD.exe
  2⤵
  PID:6272
- C:\Windows\System\LqinbUK.exe
  C:\Windows\System\LqinbUK.exe
  2⤵
  PID:6292
- C:\Windows\System\Ckdlbzq.exe
  C:\Windows\System\Ckdlbzq.exe
  2⤵
  PID:6316
- C:\Windows\System\fcgCHri.exe
  C:\Windows\System\fcgCHri.exe
  2⤵
  PID:6336
- C:\Windows\System\Cfakcfh.exe
  C:\Windows\System\Cfakcfh.exe
  2⤵
  PID:6352
- C:\Windows\System\IrJAUkF.exe
  C:\Windows\System\IrJAUkF.exe
  2⤵
  PID:6376
- C:\Windows\System\RprmKOK.exe
  C:\Windows\System\RprmKOK.exe
  2⤵
  PID:6396
- C:\Windows\System\HuChOPN.exe
  C:\Windows\System\HuChOPN.exe
  2⤵
  PID:6436
- C:\Windows\System\BqGDQHp.exe
  C:\Windows\System\BqGDQHp.exe
  2⤵
  PID:6460
- C:\Windows\System\wXDDJjn.exe
  C:\Windows\System\wXDDJjn.exe
  2⤵
  PID:6484
- C:\Windows\System\YIIwJxW.exe
  C:\Windows\System\YIIwJxW.exe
  2⤵
  PID:6500
- C:\Windows\System\dudRxxb.exe
  C:\Windows\System\dudRxxb.exe
  2⤵
  PID:6524
- C:\Windows\System\WhZBgTH.exe
  C:\Windows\System\WhZBgTH.exe
  2⤵
  PID:6572
- C:\Windows\System\hWAjQFD.exe
  C:\Windows\System\hWAjQFD.exe
  2⤵
  PID:6596
- C:\Windows\System\aVfKkwR.exe
  C:\Windows\System\aVfKkwR.exe
  2⤵
  PID:6616
- C:\Windows\System\bKDFEMh.exe
  C:\Windows\System\bKDFEMh.exe
  2⤵
  PID:6640
- C:\Windows\System\vDqcALI.exe
  C:\Windows\System\vDqcALI.exe
  2⤵
  PID:6660
- C:\Windows\System\FJDnPkv.exe
  C:\Windows\System\FJDnPkv.exe
  2⤵
  PID:6684
- C:\Windows\System\UfymsAG.exe
  C:\Windows\System\UfymsAG.exe
  2⤵
  PID:6704
- C:\Windows\System\qXInSZl.exe
  C:\Windows\System\qXInSZl.exe
  2⤵
  PID:6720
- C:\Windows\System\qqMdEqN.exe
  C:\Windows\System\qqMdEqN.exe
  2⤵
  PID:6744
- C:\Windows\System\dlRqdvC.exe
  C:\Windows\System\dlRqdvC.exe
  2⤵
  PID:6764
- C:\Windows\System\cFIKhQi.exe
  C:\Windows\System\cFIKhQi.exe
  2⤵
  PID:6788
- C:\Windows\System\NkMaJps.exe
  C:\Windows\System\NkMaJps.exe
  2⤵
  PID:6804
- C:\Windows\System\SOthgkv.exe
  C:\Windows\System\SOthgkv.exe
  2⤵
  PID:6828
- C:\Windows\System\okGsHwi.exe
  C:\Windows\System\okGsHwi.exe
  2⤵
  PID:6848
- C:\Windows\System\MxExVNT.exe
  C:\Windows\System\MxExVNT.exe
  2⤵
  PID:6876
- C:\Windows\System\VxWVYtT.exe
  C:\Windows\System\VxWVYtT.exe
  2⤵
  PID:6900
- C:\Windows\System\hOBVuRs.exe
  C:\Windows\System\hOBVuRs.exe
  2⤵
  PID:6916
- C:\Windows\System\cnZlYdV.exe
  C:\Windows\System\cnZlYdV.exe
  2⤵
  PID:6940
- C:\Windows\System\dtFfyKU.exe
  C:\Windows\System\dtFfyKU.exe
  2⤵
  PID:6960
- C:\Windows\System\JFBiCYd.exe
  C:\Windows\System\JFBiCYd.exe
  2⤵
  PID:6984
- C:\Windows\System\XKUaiKJ.exe
  C:\Windows\System\XKUaiKJ.exe
  2⤵
  PID:7004
- C:\Windows\System\uogbUxD.exe
  C:\Windows\System\uogbUxD.exe
  2⤵
  PID:7024
- C:\Windows\System\jTvEVmg.exe
  C:\Windows\System\jTvEVmg.exe
  2⤵
  PID:7040
- C:\Windows\System\wSDGhuX.exe
  C:\Windows\System\wSDGhuX.exe
  2⤵
  PID:7068
- C:\Windows\System\wGxlBDQ.exe
  C:\Windows\System\wGxlBDQ.exe
  2⤵
  PID:7092
- C:\Windows\System\BBKaSug.exe
  C:\Windows\System\BBKaSug.exe
  2⤵
  PID:7120
- C:\Windows\System\jyXyWZw.exe
  C:\Windows\System\jyXyWZw.exe
  2⤵
  PID:7136
- C:\Windows\System\kkjhfWr.exe
  C:\Windows\System\kkjhfWr.exe
  2⤵
  PID:5744
- C:\Windows\System\nbyfcut.exe
  C:\Windows\System\nbyfcut.exe
  2⤵
  PID:1432
- C:\Windows\System\WmafAIK.exe
  C:\Windows\System\WmafAIK.exe
  2⤵
  PID:5572
- C:\Windows\System\zIkZsKh.exe
  C:\Windows\System\zIkZsKh.exe
  2⤵
  PID:4680
- C:\Windows\System\xsFWbJs.exe
  C:\Windows\System\xsFWbJs.exe
  2⤵
  PID:4884
- C:\Windows\System\qMHcMrH.exe
  C:\Windows\System\qMHcMrH.exe
  2⤵
  PID:5656
- C:\Windows\System\rsgJSEp.exe
  C:\Windows\System\rsgJSEp.exe
  2⤵
  PID:3416
- C:\Windows\System\zJYlGeu.exe
  C:\Windows\System\zJYlGeu.exe
  2⤵
  PID:5692
- C:\Windows\System\dYmVZkH.exe
  C:\Windows\System\dYmVZkH.exe
  2⤵
  PID:3400
- C:\Windows\System\ownctfY.exe
  C:\Windows\System\ownctfY.exe
  2⤵
  PID:5184
- C:\Windows\System\xTNRoYC.exe
  C:\Windows\System\xTNRoYC.exe
  2⤵
  PID:5208
- C:\Windows\System\hmVMGFF.exe
  C:\Windows\System\hmVMGFF.exe
  2⤵
  PID:5240
- C:\Windows\System\hvzCpAA.exe
  C:\Windows\System\hvzCpAA.exe
  2⤵
  PID:2040
- C:\Windows\System\CTIArLI.exe
  C:\Windows\System\CTIArLI.exe
  2⤵
  PID:6148
- C:\Windows\System\NNXLnyp.exe
  C:\Windows\System\NNXLnyp.exe
  2⤵
  PID:5312
- C:\Windows\System\HcxFyUc.exe
  C:\Windows\System\HcxFyUc.exe
  2⤵
  PID:6196
- C:\Windows\System\ImhmAHa.exe
  C:\Windows\System\ImhmAHa.exe
  2⤵
  PID:6220
- C:\Windows\System\omWnkZS.exe
  C:\Windows\System\omWnkZS.exe
  2⤵
  PID:6248
- C:\Windows\System\mBJIzTc.exe
  C:\Windows\System\mBJIzTc.exe
  2⤵
  PID:5948
- C:\Windows\System\MvuWBvH.exe
  C:\Windows\System\MvuWBvH.exe
  2⤵
  PID:5968
- C:\Windows\System\vqFpMYl.exe
  C:\Windows\System\vqFpMYl.exe
  2⤵
  PID:5460
- C:\Windows\System\npZIgIE.exe
  C:\Windows\System\npZIgIE.exe
  2⤵
  PID:5412
- C:\Windows\System\tWNwIlp.exe
  C:\Windows\System\tWNwIlp.exe
  2⤵
  PID:5548
- C:\Windows\System\xMPrpOf.exe
  C:\Windows\System\xMPrpOf.exe
  2⤵
  PID:5596
- C:\Windows\System\BvmquaY.exe
  C:\Windows\System\BvmquaY.exe
  2⤵
  PID:5868
- C:\Windows\System\lljGArx.exe
  C:\Windows\System\lljGArx.exe
  2⤵
  PID:5912
- C:\Windows\System\zrbiahd.exe
  C:\Windows\System\zrbiahd.exe
  2⤵
  PID:6108
- C:\Windows\System\tWJOmXc.exe
  C:\Windows\System\tWJOmXc.exe
  2⤵
  PID:4132
- C:\Windows\System\hSFRqRg.exe
  C:\Windows\System\hSFRqRg.exe
  2⤵
  PID:4060
- C:\Windows\System\wgCPZGO.exe
  C:\Windows\System\wgCPZGO.exe
  2⤵
  PID:4852
- C:\Windows\System\OiCMVSk.exe
  C:\Windows\System\OiCMVSk.exe
  2⤵
  PID:376
- C:\Windows\System\FJDWnYe.exe
  C:\Windows\System\FJDWnYe.exe
  2⤵
  PID:6264
- C:\Windows\System\ckUNSGE.exe
  C:\Windows\System\ckUNSGE.exe
  2⤵
  PID:6348
- C:\Windows\System\LkzKqnW.exe
  C:\Windows\System\LkzKqnW.exe
  2⤵
  PID:6388
- C:\Windows\System\hricGGW.exe
  C:\Windows\System\hricGGW.exe
  2⤵
  PID:6508
- C:\Windows\System\pNdpSDD.exe
  C:\Windows\System\pNdpSDD.exe
  2⤵
  PID:6728
- C:\Windows\System\QuKHwJH.exe
  C:\Windows\System\QuKHwJH.exe
  2⤵
  PID:6924
- C:\Windows\System\seHiKYh.exe
  C:\Windows\System\seHiKYh.exe
  2⤵
  PID:7080
- C:\Windows\System\HQQeauQ.exe
  C:\Windows\System\HQQeauQ.exe
  2⤵
  PID:6456
- C:\Windows\System\ZEvVDxk.exe
  C:\Windows\System\ZEvVDxk.exe
  2⤵
  PID:6588
- C:\Windows\System\XvZwvLm.exe
  C:\Windows\System\XvZwvLm.exe
  2⤵
  PID:6796
- C:\Windows\System\hkfcXJQ.exe
  C:\Windows\System\hkfcXJQ.exe
  2⤵
  PID:6840
- C:\Windows\System\zgpnxOX.exe
  C:\Windows\System\zgpnxOX.exe
  2⤵
  PID:7180
- C:\Windows\System\xuHSVnf.exe
  C:\Windows\System\xuHSVnf.exe
  2⤵
  PID:7204
- C:\Windows\System\iSSkPCs.exe
  C:\Windows\System\iSSkPCs.exe
  2⤵
  PID:7220
- C:\Windows\System\iypswRU.exe
  C:\Windows\System\iypswRU.exe
  2⤵
  PID:7244
- C:\Windows\System\kxOTQAi.exe
  C:\Windows\System\kxOTQAi.exe
  2⤵
  PID:7264
- C:\Windows\System\yTRHsSc.exe
  C:\Windows\System\yTRHsSc.exe
  2⤵
  PID:7284
- C:\Windows\System\bvqVPZA.exe
  C:\Windows\System\bvqVPZA.exe
  2⤵
  PID:7308
- C:\Windows\System\UQhCgqw.exe
  C:\Windows\System\UQhCgqw.exe
  2⤵
  PID:7324
- C:\Windows\System\pDkDEaR.exe
  C:\Windows\System\pDkDEaR.exe
  2⤵
  PID:7348
- C:\Windows\System\wvUxyqU.exe
  C:\Windows\System\wvUxyqU.exe
  2⤵
  PID:7368
- C:\Windows\System\FxEtsDA.exe
  C:\Windows\System\FxEtsDA.exe
  2⤵
  PID:7384
- C:\Windows\System\kMPGROL.exe
  C:\Windows\System\kMPGROL.exe
  2⤵
  PID:7408
- C:\Windows\System\NurDIdE.exe
  C:\Windows\System\NurDIdE.exe
  2⤵
  PID:7428
- C:\Windows\System\aTQUhcR.exe
  C:\Windows\System\aTQUhcR.exe
  2⤵
  PID:7448
- C:\Windows\System\NHOLexa.exe
  C:\Windows\System\NHOLexa.exe
  2⤵
  PID:7468
- C:\Windows\System\xJceVYL.exe
  C:\Windows\System\xJceVYL.exe
  2⤵
  PID:7488
- C:\Windows\System\sjRFOCT.exe
  C:\Windows\System\sjRFOCT.exe
  2⤵
  PID:7512
- C:\Windows\System\ZZYFQOl.exe
  C:\Windows\System\ZZYFQOl.exe
  2⤵
  PID:7528
- C:\Windows\System\hotIPYr.exe
  C:\Windows\System\hotIPYr.exe
  2⤵
  PID:7552
- C:\Windows\System\sieOBOP.exe
  C:\Windows\System\sieOBOP.exe
  2⤵
  PID:7576
- C:\Windows\System\XqOTYYn.exe
  C:\Windows\System\XqOTYYn.exe
  2⤵
  PID:7600
- C:\Windows\System\VcTVxKN.exe
  C:\Windows\System\VcTVxKN.exe
  2⤵
  PID:7620
- C:\Windows\System\ZWnFowK.exe
  C:\Windows\System\ZWnFowK.exe
  2⤵
  PID:7644
- C:\Windows\System\MFdfzXU.exe
  C:\Windows\System\MFdfzXU.exe
  2⤵
  PID:7668
- C:\Windows\System\neIObNR.exe
  C:\Windows\System\neIObNR.exe
  2⤵
  PID:7692
- C:\Windows\System\ZKxjDGM.exe
  C:\Windows\System\ZKxjDGM.exe
  2⤵
  PID:7716
- C:\Windows\System\NyFnzHw.exe
  C:\Windows\System\NyFnzHw.exe
  2⤵
  PID:7736
- C:\Windows\System\wuYOnKs.exe
  C:\Windows\System\wuYOnKs.exe
  2⤵
  PID:7760
- C:\Windows\System\EFiQztt.exe
  C:\Windows\System\EFiQztt.exe
  2⤵
  PID:7784
- C:\Windows\System\ZJCCXUs.exe
  C:\Windows\System\ZJCCXUs.exe
  2⤵
  PID:7808
- C:\Windows\System\WsoiHei.exe
  C:\Windows\System\WsoiHei.exe
  2⤵
  PID:7828
- C:\Windows\System\rjDRWUr.exe
  C:\Windows\System\rjDRWUr.exe
  2⤵
  PID:7852
- C:\Windows\System\gwvgVqH.exe
  C:\Windows\System\gwvgVqH.exe
  2⤵
  PID:7988
- C:\Windows\System\RQoIERM.exe
  C:\Windows\System\RQoIERM.exe
  2⤵
  PID:8004
- C:\Windows\System\ZRLMeyS.exe
  C:\Windows\System\ZRLMeyS.exe
  2⤵
  PID:8028
- C:\Windows\System\rNaTCGN.exe
  C:\Windows\System\rNaTCGN.exe
  2⤵
  PID:8052
- C:\Windows\System\FVHGXJZ.exe
  C:\Windows\System\FVHGXJZ.exe
  2⤵
  PID:8080
- C:\Windows\System\rYvhoST.exe
  C:\Windows\System\rYvhoST.exe
  2⤵
  PID:8100
- C:\Windows\System\mFCqGFR.exe
  C:\Windows\System\mFCqGFR.exe
  2⤵
  PID:8120
- C:\Windows\System\ZDQovjp.exe
  C:\Windows\System\ZDQovjp.exe
  2⤵
  PID:8136
- C:\Windows\System\DxJFdCq.exe
  C:\Windows\System\DxJFdCq.exe
  2⤵
  PID:8156
- C:\Windows\System\huddLzR.exe
  C:\Windows\System\huddLzR.exe
  2⤵
  PID:8176
- C:\Windows\System\skKbCUq.exe
  C:\Windows\System\skKbCUq.exe
  2⤵
  PID:7108
- C:\Windows\System\eAlCATm.exe
  C:\Windows\System\eAlCATm.exe
  2⤵
  PID:6692
- C:\Windows\System\kcImIxq.exe
  C:\Windows\System\kcImIxq.exe
  2⤵
  PID:6860
- C:\Windows\System\bfAUtqs.exe
  C:\Windows\System\bfAUtqs.exe
  2⤵
  PID:7048
- C:\Windows\System\bfoOBHG.exe
  C:\Windows\System\bfoOBHG.exe
  2⤵
  PID:6584
- C:\Windows\System\bSKUtII.exe
  C:\Windows\System\bSKUtII.exe
  2⤵
  PID:6908
- C:\Windows\System\WhwokGm.exe
  C:\Windows\System\WhwokGm.exe
  2⤵
  PID:6976
- C:\Windows\System\CrjfgQi.exe
  C:\Windows\System\CrjfgQi.exe
  2⤵
  PID:2644
- C:\Windows\System\NbwcMrS.exe
  C:\Windows\System\NbwcMrS.exe
  2⤵
  PID:8196
- C:\Windows\System\CTXcpLz.exe
  C:\Windows\System\CTXcpLz.exe
  2⤵
  PID:8220
- C:\Windows\System\hplztyz.exe
  C:\Windows\System\hplztyz.exe
  2⤵
  PID:8236
- C:\Windows\System\dBwMlRF.exe
  C:\Windows\System\dBwMlRF.exe
  2⤵
  PID:8256
- C:\Windows\System\wfqqkhx.exe
  C:\Windows\System\wfqqkhx.exe
  2⤵
  PID:8276
- C:\Windows\System\uSLytxL.exe
  C:\Windows\System\uSLytxL.exe
  2⤵
  PID:8296
- C:\Windows\System\XIKcitJ.exe
  C:\Windows\System\XIKcitJ.exe
  2⤵
  PID:8320
- C:\Windows\System\HUNtaFK.exe
  C:\Windows\System\HUNtaFK.exe
  2⤵
  PID:8344
- C:\Windows\System\wOdquhQ.exe
  C:\Windows\System\wOdquhQ.exe
  2⤵
  PID:8360
- C:\Windows\System\iUaiSIx.exe
  C:\Windows\System\iUaiSIx.exe
  2⤵
  PID:8388
- C:\Windows\System\jaLtjza.exe
  C:\Windows\System\jaLtjza.exe
  2⤵
  PID:8416
- C:\Windows\System\wwDvAcC.exe
  C:\Windows\System\wwDvAcC.exe
  2⤵
  PID:8444
- C:\Windows\System\GuQMYVq.exe
  C:\Windows\System\GuQMYVq.exe
  2⤵
  PID:8464
- C:\Windows\System\FMjrJAb.exe
  C:\Windows\System\FMjrJAb.exe
  2⤵
  PID:8480
- C:\Windows\System\ocTWNTu.exe
  C:\Windows\System\ocTWNTu.exe
  2⤵
  PID:8504
- C:\Windows\System\NYHOODE.exe
  C:\Windows\System\NYHOODE.exe
  2⤵
  PID:8528
- C:\Windows\System\AIHeYUN.exe
  C:\Windows\System\AIHeYUN.exe
  2⤵
  PID:8548
- C:\Windows\System\RPrFyUC.exe
  C:\Windows\System\RPrFyUC.exe
  2⤵
  PID:8572
- C:\Windows\System\EbagyCK.exe
  C:\Windows\System\EbagyCK.exe
  2⤵
  PID:8596
- C:\Windows\System\rxOOEwR.exe
  C:\Windows\System\rxOOEwR.exe
  2⤵
  PID:8620
- C:\Windows\System\gLciuvC.exe
  C:\Windows\System\gLciuvC.exe
  2⤵
  PID:8636
- C:\Windows\System\sYNnmxZ.exe
  C:\Windows\System\sYNnmxZ.exe
  2⤵
  PID:8668
- C:\Windows\System\hLKoLuG.exe
  C:\Windows\System\hLKoLuG.exe
  2⤵
  PID:8688
- C:\Windows\System\KIqNata.exe
  C:\Windows\System\KIqNata.exe
  2⤵
  PID:8712
- C:\Windows\System\HpIWZuN.exe
  C:\Windows\System\HpIWZuN.exe
  2⤵
  PID:8744
- C:\Windows\System\vIaNDKs.exe
  C:\Windows\System\vIaNDKs.exe
  2⤵
  PID:8872
- C:\Windows\System\bwgxYKk.exe
  C:\Windows\System\bwgxYKk.exe
  2⤵
  PID:8892
- C:\Windows\System\YHjLlGe.exe
  C:\Windows\System\YHjLlGe.exe
  2⤵
  PID:8916
- C:\Windows\System\wiQebKd.exe
  C:\Windows\System\wiQebKd.exe
  2⤵
  PID:8936
- C:\Windows\System\YEWZnge.exe
  C:\Windows\System\YEWZnge.exe
  2⤵
  PID:8964
- C:\Windows\System\JXeyneB.exe
  C:\Windows\System\JXeyneB.exe
  2⤵
  PID:8980
- C:\Windows\System\smHyeke.exe
  C:\Windows\System\smHyeke.exe
  2⤵
  PID:9000
- C:\Windows\System\ccSjIPs.exe
  C:\Windows\System\ccSjIPs.exe
  2⤵
  PID:9024
- C:\Windows\System\zADmvzV.exe
  C:\Windows\System\zADmvzV.exe
  2⤵
  PID:9044
- C:\Windows\System\TWMECqz.exe
  C:\Windows\System\TWMECqz.exe
  2⤵
  PID:9064
- C:\Windows\System\OHcDCju.exe
  C:\Windows\System\OHcDCju.exe
  2⤵
  PID:9088
- C:\Windows\System\dtrIHsK.exe
  C:\Windows\System\dtrIHsK.exe
  2⤵
  PID:9112
- C:\Windows\System\aHmXgJn.exe
  C:\Windows\System\aHmXgJn.exe
  2⤵
  PID:9132
- C:\Windows\System\gDWnHyb.exe
  C:\Windows\System\gDWnHyb.exe
  2⤵
  PID:9152
- C:\Windows\System\IPcqFrr.exe
  C:\Windows\System\IPcqFrr.exe
  2⤵
  PID:9176
- C:\Windows\System\qTfwEDR.exe
  C:\Windows\System\qTfwEDR.exe
  2⤵
  PID:9192
- C:\Windows\System\ONRmnsM.exe
  C:\Windows\System\ONRmnsM.exe
  2⤵
  PID:7296
- C:\Windows\System\bWekInI.exe
  C:\Windows\System\bWekInI.exe
  2⤵
  PID:7344
- C:\Windows\System\AydYdCR.exe
  C:\Windows\System\AydYdCR.exe
  2⤵
  PID:7364
- C:\Windows\System\XNDeyED.exe
  C:\Windows\System\XNDeyED.exe
  2⤵
  PID:7392
- C:\Windows\System\bNrXCxf.exe
  C:\Windows\System\bNrXCxf.exe
  2⤵
  PID:3600
- C:\Windows\System\zDVZcSb.exe
  C:\Windows\System\zDVZcSb.exe
  2⤵
  PID:7456
- C:\Windows\System\DJJMNqb.exe
  C:\Windows\System\DJJMNqb.exe
  2⤵
  PID:7508
- C:\Windows\System\WXVezoR.exe
  C:\Windows\System\WXVezoR.exe
  2⤵
  PID:7544
- C:\Windows\System\ARUjLsk.exe
  C:\Windows\System\ARUjLsk.exe
  2⤵
  PID:7612
- C:\Windows\System\OtCqPiC.exe
  C:\Windows\System\OtCqPiC.exe
  2⤵
  PID:7636
- C:\Windows\System\SBArQTp.exe
  C:\Windows\System\SBArQTp.exe
  2⤵
  PID:2780
- C:\Windows\System\rquNyJy.exe
  C:\Windows\System\rquNyJy.exe
  2⤵
  PID:7712
- C:\Windows\System\rDZhWGF.exe
  C:\Windows\System\rDZhWGF.exe
  2⤵
  PID:4196
- C:\Windows\System\zNSnJEe.exe
  C:\Windows\System\zNSnJEe.exe
  2⤵
  PID:6540
- C:\Windows\System\AhfjFsL.exe
  C:\Windows\System\AhfjFsL.exe
  2⤵
  PID:6672
- C:\Windows\System\KVFqtyU.exe
  C:\Windows\System\KVFqtyU.exe
  2⤵
  PID:6612
- C:\Windows\System\wQGmOQO.exe
  C:\Windows\System\wQGmOQO.exe
  2⤵
  PID:5772
- C:\Windows\System\ZiSILjo.exe
  C:\Windows\System\ZiSILjo.exe
  2⤵
  PID:7260
- C:\Windows\System\kPlYmhL.exe
  C:\Windows\System\kPlYmhL.exe
  2⤵
  PID:2148
- C:\Windows\System\cwqkJQj.exe
  C:\Windows\System\cwqkJQj.exe
  2⤵
  PID:7060
- C:\Windows\System\LWIKliD.exe
  C:\Windows\System\LWIKliD.exe
  2⤵
  PID:7400
- C:\Windows\System\RgNoHJl.exe
  C:\Windows\System\RgNoHJl.exe
  2⤵
  PID:7568
- C:\Windows\System\QUUAyOq.exe
  C:\Windows\System\QUUAyOq.exe
  2⤵
  PID:9240
- C:\Windows\System\KjybNTB.exe
  C:\Windows\System\KjybNTB.exe
  2⤵
  PID:9256
- C:\Windows\System\LXBLlYm.exe
  C:\Windows\System\LXBLlYm.exe
  2⤵
  PID:9280
- C:\Windows\System\SOfDZDb.exe
  C:\Windows\System\SOfDZDb.exe
  2⤵
  PID:9304
- C:\Windows\System\MngdxJn.exe
  C:\Windows\System\MngdxJn.exe
  2⤵
  PID:9336
- C:\Windows\System\kKpWYIV.exe
  C:\Windows\System\kKpWYIV.exe
  2⤵
  PID:9352
- C:\Windows\System\zXZSKHt.exe
  C:\Windows\System\zXZSKHt.exe
  2⤵
  PID:9380
- C:\Windows\System\jmzWjjW.exe
  C:\Windows\System\jmzWjjW.exe
  2⤵
  PID:9400
- C:\Windows\System\oWsKiAJ.exe
  C:\Windows\System\oWsKiAJ.exe
  2⤵
  PID:9424
- C:\Windows\System\ydrVEjN.exe
  C:\Windows\System\ydrVEjN.exe
  2⤵
  PID:9448
- C:\Windows\System\AcRbDQc.exe
  C:\Windows\System\AcRbDQc.exe
  2⤵
  PID:9472
- C:\Windows\System\MaVgXKs.exe
  C:\Windows\System\MaVgXKs.exe
  2⤵
  PID:9492
- C:\Windows\System\addanAC.exe
  C:\Windows\System\addanAC.exe
  2⤵
  PID:9516
- C:\Windows\System\FqDfifV.exe
  C:\Windows\System\FqDfifV.exe
  2⤵
  PID:9540
- C:\Windows\System\WkCfoEk.exe
  C:\Windows\System\WkCfoEk.exe
  2⤵
  PID:9556
- C:\Windows\System\ddNKGbP.exe
  C:\Windows\System\ddNKGbP.exe
  2⤵
  PID:9584
- C:\Windows\System\NhSmDJR.exe
  C:\Windows\System\NhSmDJR.exe
  2⤵
  PID:9600
- C:\Windows\System\cZHsInK.exe
  C:\Windows\System\cZHsInK.exe
  2⤵
  PID:9616
- C:\Windows\System\shCkRZj.exe
  C:\Windows\System\shCkRZj.exe
  2⤵
  PID:9632
- C:\Windows\System\PMAKnFT.exe
  C:\Windows\System\PMAKnFT.exe
  2⤵
  PID:9652
- C:\Windows\System\hJJjrZA.exe
  C:\Windows\System\hJJjrZA.exe
  2⤵
  PID:9676
- C:\Windows\System\pdnKHVe.exe
  C:\Windows\System\pdnKHVe.exe
  2⤵
  PID:9700
- C:\Windows\System\NQPApUf.exe
  C:\Windows\System\NQPApUf.exe
  2⤵
  PID:9716
- C:\Windows\System\NMFAztq.exe
  C:\Windows\System\NMFAztq.exe
  2⤵
  PID:9740
- C:\Windows\System\SkTOiBA.exe
  C:\Windows\System\SkTOiBA.exe
  2⤵
  PID:9764
- C:\Windows\System\avyrNGf.exe
  C:\Windows\System\avyrNGf.exe
  2⤵
  PID:9784
- C:\Windows\System\lAyOJlA.exe
  C:\Windows\System\lAyOJlA.exe
  2⤵
  PID:9804
- C:\Windows\System\DpbjfAw.exe
  C:\Windows\System\DpbjfAw.exe
  2⤵
  PID:9828
- C:\Windows\System\ZXuoMnt.exe
  C:\Windows\System\ZXuoMnt.exe
  2⤵
  PID:9856
- C:\Windows\System\nKKEKiw.exe
  C:\Windows\System\nKKEKiw.exe
  2⤵
  PID:9876
- C:\Windows\System\xhodmAK.exe
  C:\Windows\System\xhodmAK.exe
  2⤵
  PID:9900
- C:\Windows\System\qVkdYha.exe
  C:\Windows\System\qVkdYha.exe
  2⤵
  PID:9916
- C:\Windows\System\aJNYLKT.exe
  C:\Windows\System\aJNYLKT.exe
  2⤵
  PID:9944
- C:\Windows\System\YMhiiod.exe
  C:\Windows\System\YMhiiod.exe
  2⤵
  PID:9984
- C:\Windows\System\eipIXPp.exe
  C:\Windows\System\eipIXPp.exe
  2⤵
  PID:10024
- C:\Windows\System\xFhWQJL.exe
  C:\Windows\System\xFhWQJL.exe
  2⤵
  PID:10048
- C:\Windows\System\vLpDVKB.exe
  C:\Windows\System\vLpDVKB.exe
  2⤵
  PID:10072
- C:\Windows\System\BGgtPol.exe
  C:\Windows\System\BGgtPol.exe
  2⤵
  PID:10120
- C:\Windows\System\hrmDCsI.exe
  C:\Windows\System\hrmDCsI.exe
  2⤵
  PID:10152
- C:\Windows\System\BqZGZFX.exe
  C:\Windows\System\BqZGZFX.exe
  2⤵
  PID:10172
- C:\Windows\System\yrtMHdW.exe
  C:\Windows\System\yrtMHdW.exe
  2⤵
  PID:10196
- C:\Windows\System\dAANITy.exe
  C:\Windows\System\dAANITy.exe
  2⤵
  PID:10220
- C:\Windows\System\fZqlGdy.exe
  C:\Windows\System\fZqlGdy.exe
  2⤵
  PID:8460
- C:\Windows\System\HCpPUzB.exe
  C:\Windows\System\HCpPUzB.exe
  2⤵
  PID:8564
- C:\Windows\System\BQtdoao.exe
  C:\Windows\System\BQtdoao.exe
  2⤵
  PID:8724
- C:\Windows\System\MHHQDFz.exe
  C:\Windows\System\MHHQDFz.exe
  2⤵
  PID:7744
- C:\Windows\System\qyxBOwg.exe
  C:\Windows\System\qyxBOwg.exe
  2⤵
  PID:2084
- C:\Windows\System\iHQBUqW.exe
  C:\Windows\System\iHQBUqW.exe
  2⤵
  PID:7824
- C:\Windows\System\HedBFYr.exe
  C:\Windows\System\HedBFYr.exe
  2⤵
  PID:4076
- C:\Windows\System\wPCsbcs.exe
  C:\Windows\System\wPCsbcs.exe
  2⤵
  PID:2312
- C:\Windows\System\dSfpNGG.exe
  C:\Windows\System\dSfpNGG.exe
  2⤵
  PID:5156
- C:\Windows\System\yUoxLTr.exe
  C:\Windows\System\yUoxLTr.exe
  2⤵
  PID:5228
- C:\Windows\System\FELbJUK.exe
  C:\Windows\System\FELbJUK.exe
  2⤵
  PID:2380
- C:\Windows\System\scMpgxa.exe
  C:\Windows\System\scMpgxa.exe
  2⤵
  PID:6180
- C:\Windows\System\bzciErJ.exe
  C:\Windows\System\bzciErJ.exe
  2⤵
  PID:6240
- C:\Windows\System\CvfjqZB.exe
  C:\Windows\System\CvfjqZB.exe
  2⤵
  PID:5952
- C:\Windows\System\JGfWXmx.exe
  C:\Windows\System\JGfWXmx.exe
  2⤵
  PID:5532
- C:\Windows\System\bpLFKID.exe
  C:\Windows\System\bpLFKID.exe
  2⤵
  PID:2904
- C:\Windows\System\aVIEddh.exe
  C:\Windows\System\aVIEddh.exe
  2⤵
  PID:3208
- C:\Windows\System\EmbGrdH.exe
  C:\Windows\System\EmbGrdH.exe
  2⤵
  PID:2276
- C:\Windows\System\lQynJsS.exe
  C:\Windows\System\lQynJsS.exe
  2⤵
  PID:4444
- C:\Windows\System\dbFJqXz.exe
  C:\Windows\System\dbFJqXz.exe
  2⤵
  PID:6344
- C:\Windows\System\pZBHBOf.exe
  C:\Windows\System\pZBHBOf.exe
  2⤵
  PID:4692
- C:\Windows\System\sYLWzwY.exe
  C:\Windows\System\sYLWzwY.exe
  2⤵
  PID:1748
- C:\Windows\System\IvnVPVu.exe
  C:\Windows\System\IvnVPVu.exe
  2⤵
  PID:8956
- C:\Windows\System\yrCuiQo.exe
  C:\Windows\System\yrCuiQo.exe
  2⤵
  PID:8996
- C:\Windows\System\UQrckoP.exe
  C:\Windows\System\UQrckoP.exe
  2⤵
  PID:6784
- C:\Windows\System\pzjSwVf.exe
  C:\Windows\System\pzjSwVf.exe
  2⤵
  PID:6480
- C:\Windows\System\jJqAeQH.exe
  C:\Windows\System\jJqAeQH.exe
  2⤵
  PID:9072
- C:\Windows\System\gXFAJNI.exe
  C:\Windows\System\gXFAJNI.exe
  2⤵
  PID:9128
- C:\Windows\System\VzHCfPA.exe
  C:\Windows\System\VzHCfPA.exe
  2⤵
  PID:9164
- C:\Windows\System\kZRGhwW.exe
  C:\Windows\System\kZRGhwW.exe
  2⤵
  PID:9208
- C:\Windows\System\yYpKOpt.exe
  C:\Windows\System\yYpKOpt.exe
  2⤵
  PID:7336
- C:\Windows\System\mTYzqqK.exe
  C:\Windows\System\mTYzqqK.exe
  2⤵
  PID:8248
- C:\Windows\System\pQBHeWC.exe
  C:\Windows\System\pQBHeWC.exe
  2⤵
  PID:8284
- C:\Windows\System\XphoXKX.exe
  C:\Windows\System\XphoXKX.exe
  2⤵
  PID:7596
- C:\Windows\System\LgTAEuZ.exe
  C:\Windows\System\LgTAEuZ.exe
  2⤵
  PID:6652
- C:\Windows\System\givEWPa.exe
  C:\Windows\System\givEWPa.exe
  2⤵
  PID:10252
- C:\Windows\System\xrLrCut.exe
  C:\Windows\System\xrLrCut.exe
  2⤵
  PID:10276
- C:\Windows\System\ykdBlXn.exe
  C:\Windows\System\ykdBlXn.exe
  2⤵
  PID:10296
- C:\Windows\System\gVTzvbP.exe
  C:\Windows\System\gVTzvbP.exe
  2⤵
  PID:10320
- C:\Windows\System\CJheQwb.exe
  C:\Windows\System\CJheQwb.exe
  2⤵
  PID:10340
- C:\Windows\System\vEVaWaa.exe
  C:\Windows\System\vEVaWaa.exe
  2⤵
  PID:10364
- C:\Windows\System\bZtENlx.exe
  C:\Windows\System\bZtENlx.exe
  2⤵
  PID:10384
- C:\Windows\System\ZODGaFa.exe
  C:\Windows\System\ZODGaFa.exe
  2⤵
  PID:10408
- C:\Windows\System\unzHVfq.exe
  C:\Windows\System\unzHVfq.exe
  2⤵
  PID:10428
- C:\Windows\System\QnMpzhy.exe
  C:\Windows\System\QnMpzhy.exe
  2⤵
  PID:10448
- C:\Windows\System\wCZhxcQ.exe
  C:\Windows\System\wCZhxcQ.exe
  2⤵
  PID:10468
- C:\Windows\System\EDHKhVv.exe
  C:\Windows\System\EDHKhVv.exe
  2⤵
  PID:10488
- C:\Windows\System\zZrotUy.exe
  C:\Windows\System\zZrotUy.exe
  2⤵
  PID:10508
- C:\Windows\System\Paedmwa.exe
  C:\Windows\System\Paedmwa.exe
  2⤵
  PID:10532
- C:\Windows\System\AlxWeXV.exe
  C:\Windows\System\AlxWeXV.exe
  2⤵
  PID:10556
- C:\Windows\System\xRKoHfO.exe
  C:\Windows\System\xRKoHfO.exe
  2⤵
  PID:10576
- C:\Windows\System\pnNjKOE.exe
  C:\Windows\System\pnNjKOE.exe
  2⤵
  PID:10596
- C:\Windows\System\DWndgOS.exe
  C:\Windows\System\DWndgOS.exe
  2⤵
  PID:10616
- C:\Windows\System\fAvqMfe.exe
  C:\Windows\System\fAvqMfe.exe
  2⤵
  PID:10632
- C:\Windows\System\soORRuh.exe
  C:\Windows\System\soORRuh.exe
  2⤵
  PID:10656
- C:\Windows\System\mXPlTxC.exe
  C:\Windows\System\mXPlTxC.exe
  2⤵
  PID:10680
- C:\Windows\System\tCDMwPU.exe
  C:\Windows\System\tCDMwPU.exe
  2⤵
  PID:10700
- C:\Windows\System\xIkQlWg.exe
  C:\Windows\System\xIkQlWg.exe
  2⤵
  PID:10720
- C:\Windows\System\osDYtVj.exe
  C:\Windows\System\osDYtVj.exe
  2⤵
  PID:10756
- C:\Windows\System\hDecRjD.exe
  C:\Windows\System\hDecRjD.exe
  2⤵
  PID:10776
- C:\Windows\System\DDAvbsp.exe
  C:\Windows\System\DDAvbsp.exe
  2⤵
  PID:10804
- C:\Windows\System\BFFbkjn.exe
  C:\Windows\System\BFFbkjn.exe
  2⤵
  PID:10828
- C:\Windows\System\kmhTUUO.exe
  C:\Windows\System\kmhTUUO.exe
  2⤵
  PID:10844
- C:\Windows\System\RzcRIkM.exe
  C:\Windows\System\RzcRIkM.exe
  2⤵
  PID:10868
- C:\Windows\System\guZllxn.exe
  C:\Windows\System\guZllxn.exe
  2⤵
  PID:10888
- C:\Windows\System\tZDHcbO.exe
  C:\Windows\System\tZDHcbO.exe
  2⤵
  PID:10912
- C:\Windows\System\XzRwxGH.exe
  C:\Windows\System\XzRwxGH.exe
  2⤵
  PID:10932
- C:\Windows\System\EnvsuZG.exe
  C:\Windows\System\EnvsuZG.exe
  2⤵
  PID:10952
- C:\Windows\System\ZSVCWQR.exe
  C:\Windows\System\ZSVCWQR.exe
  2⤵
  PID:10968
- C:\Windows\System\FMweKlD.exe
  C:\Windows\System\FMweKlD.exe
  2⤵
  PID:10992
- C:\Windows\System\wijttzr.exe
  C:\Windows\System\wijttzr.exe
  2⤵
  PID:11012
- C:\Windows\System\wTNHrlI.exe
  C:\Windows\System\wTNHrlI.exe
  2⤵
  PID:11032
- C:\Windows\System\mYTCZOD.exe
  C:\Windows\System\mYTCZOD.exe
  2⤵
  PID:11052
- C:\Windows\System\uOsJKmJ.exe
  C:\Windows\System\uOsJKmJ.exe
  2⤵
  PID:11084
- C:\Windows\System\Qnmqbnt.exe
  C:\Windows\System\Qnmqbnt.exe
  2⤵
  PID:7588
- C:\Windows\System\YqarTLN.exe
  C:\Windows\System\YqarTLN.exe
  2⤵
  PID:8512
- C:\Windows\System\VhunSQa.exe
  C:\Windows\System\VhunSQa.exe
  2⤵
  PID:8592
- C:\Windows\System\SqtmlOP.exe
  C:\Windows\System\SqtmlOP.exe
  2⤵
  PID:9344
- C:\Windows\System\LXCUUGl.exe
  C:\Windows\System\LXCUUGl.exe
  2⤵
  PID:9396
- C:\Windows\System\osgsEEW.exe
  C:\Windows\System\osgsEEW.exe
  2⤵
  PID:9436
- C:\Windows\System\wzDIOxf.exe
  C:\Windows\System\wzDIOxf.exe
  2⤵
  PID:9548
- C:\Windows\System\wumdCdG.exe
  C:\Windows\System\wumdCdG.exe
  2⤵
  PID:9664
- C:\Windows\System\hXNPGhT.exe
  C:\Windows\System\hXNPGhT.exe
  2⤵
  PID:9756
- C:\Windows\System\tfMzOyp.exe
  C:\Windows\System\tfMzOyp.exe
  2⤵
  PID:9912
- C:\Windows\System\ITYdNOn.exe
  C:\Windows\System\ITYdNOn.exe
  2⤵
  PID:7976
- C:\Windows\System\rFOyGWt.exe
  C:\Windows\System\rFOyGWt.exe
  2⤵
  PID:8020
- C:\Windows\System\KiNvURS.exe
  C:\Windows\System\KiNvURS.exe
  2⤵
  PID:8060
- C:\Windows\System\yRBNfPY.exe
  C:\Windows\System\yRBNfPY.exe
  2⤵
  PID:8092
- C:\Windows\System\YGyzoTP.exe
  C:\Windows\System\YGyzoTP.exe
  2⤵
  PID:8132
- C:\Windows\System\pbGKbwd.exe
  C:\Windows\System\pbGKbwd.exe
  2⤵
  PID:8168
- C:\Windows\System\GhssKai.exe
  C:\Windows\System\GhssKai.exe
  2⤵
  PID:6628
- C:\Windows\System\olBcjBd.exe
  C:\Windows\System\olBcjBd.exe
  2⤵
  PID:9040
- C:\Windows\System\ujmWYbn.exe
  C:\Windows\System\ujmWYbn.exe
  2⤵
  PID:9188
- C:\Windows\System\YVHkNEl.exe
  C:\Windows\System\YVHkNEl.exe
  2⤵
  PID:6228
- C:\Windows\System\FEUrlrh.exe
  C:\Windows\System\FEUrlrh.exe
  2⤵
  PID:7020
- C:\Windows\System\fUXOkyN.exe
  C:\Windows\System\fUXOkyN.exe
  2⤵
  PID:7216
- C:\Windows\System\xmOsjci.exe
  C:\Windows\System\xmOsjci.exe
  2⤵
  PID:8972
- C:\Windows\System\MQcbnXe.exe
  C:\Windows\System\MQcbnXe.exe
  2⤵
  PID:11272
- C:\Windows\System\ZQpAKLe.exe
  C:\Windows\System\ZQpAKLe.exe
  2⤵
  PID:11292
- C:\Windows\System\CoLzcvC.exe
  C:\Windows\System\CoLzcvC.exe
  2⤵
  PID:11312
- C:\Windows\System\WhbTXQS.exe
  C:\Windows\System\WhbTXQS.exe
  2⤵
  PID:11340
- C:\Windows\System\HbZRWax.exe
  C:\Windows\System\HbZRWax.exe
  2⤵
  PID:11360
- C:\Windows\System\AcGjXje.exe
  C:\Windows\System\AcGjXje.exe
  2⤵
  PID:11380
- C:\Windows\System\thyBMlF.exe
  C:\Windows\System\thyBMlF.exe
  2⤵
  PID:11400
- C:\Windows\System\VJFuIiE.exe
  C:\Windows\System\VJFuIiE.exe
  2⤵
  PID:11452
- C:\Windows\System\gsBNyab.exe
  C:\Windows\System\gsBNyab.exe
  2⤵
  PID:11476
- C:\Windows\System\mQHHIQb.exe
  C:\Windows\System\mQHHIQb.exe
  2⤵
  PID:11500
- C:\Windows\System\zaEudjP.exe
  C:\Windows\System\zaEudjP.exe
  2⤵
  PID:11520
- C:\Windows\System\RJPidTq.exe
  C:\Windows\System\RJPidTq.exe
  2⤵
  PID:11544
- C:\Windows\System\LetNRia.exe
  C:\Windows\System\LetNRia.exe
  2⤵
  PID:11564
- C:\Windows\System\bKpDoPD.exe
  C:\Windows\System\bKpDoPD.exe
  2⤵
  PID:11584
- C:\Windows\System\yefpESi.exe
  C:\Windows\System\yefpESi.exe
  2⤵
  PID:11608
- C:\Windows\System\RJnWgFT.exe
  C:\Windows\System\RJnWgFT.exe
  2⤵
  PID:11628
- C:\Windows\System\HIqkdnX.exe
  C:\Windows\System\HIqkdnX.exe
  2⤵
  PID:11656
- C:\Windows\System\xkzhJOG.exe
  C:\Windows\System\xkzhJOG.exe
  2⤵
  PID:11672
- C:\Windows\System\fyNpUME.exe
  C:\Windows\System\fyNpUME.exe
  2⤵
  PID:11700
- C:\Windows\System\jtCphpD.exe
  C:\Windows\System\jtCphpD.exe
  2⤵
  PID:11720
- C:\Windows\System\fUeVhxQ.exe
  C:\Windows\System\fUeVhxQ.exe
  2⤵
  PID:11756
- C:\Windows\System\RKRztnw.exe
  C:\Windows\System\RKRztnw.exe
  2⤵
  PID:11776
- C:\Windows\System\mRHpTQF.exe
  C:\Windows\System\mRHpTQF.exe
  2⤵
  PID:11792
- C:\Windows\System\rDSKDtx.exe
  C:\Windows\System\rDSKDtx.exe
  2⤵
  PID:11808
- C:\Windows\System\OpvCWIB.exe
  C:\Windows\System\OpvCWIB.exe
  2⤵
  PID:11828
- C:\Windows\System\lfKUPLv.exe
  C:\Windows\System\lfKUPLv.exe
  2⤵
  PID:11844
- C:\Windows\System\IWxBcVg.exe
  C:\Windows\System\IWxBcVg.exe
  2⤵
  PID:11876
- C:\Windows\System\WWVYcZu.exe
  C:\Windows\System\WWVYcZu.exe
  2⤵
  PID:11900
- C:\Windows\System\FeKmBdk.exe
  C:\Windows\System\FeKmBdk.exe
  2⤵
  PID:11920
- C:\Windows\System\tQwSdQD.exe
  C:\Windows\System\tQwSdQD.exe
  2⤵
  PID:11948
- C:\Windows\System\LKHjXfv.exe
  C:\Windows\System\LKHjXfv.exe
  2⤵
  PID:11968
- C:\Windows\System\kYAUToD.exe
  C:\Windows\System\kYAUToD.exe
  2⤵
  PID:11988
- C:\Windows\System\oTLKEhc.exe
  C:\Windows\System\oTLKEhc.exe
  2⤵
  PID:12012
- C:\Windows\System\ojqdohU.exe
  C:\Windows\System\ojqdohU.exe
  2⤵
  PID:12052
- C:\Windows\System\IXwGjon.exe
  C:\Windows\System\IXwGjon.exe
  2⤵
  PID:12068
- C:\Windows\System\POYUqmD.exe
  C:\Windows\System\POYUqmD.exe
  2⤵
  PID:12092
- C:\Windows\System\rukGpQf.exe
  C:\Windows\System\rukGpQf.exe
  2⤵
  PID:12216
- C:\Windows\System\PNYqlLE.exe
  C:\Windows\System\PNYqlLE.exe
  2⤵
  PID:12236
- C:\Windows\System\eqTxHrs.exe
  C:\Windows\System\eqTxHrs.exe
  2⤵
  PID:12264
- C:\Windows\System\yrDFGJu.exe
  C:\Windows\System\yrDFGJu.exe
  2⤵
  PID:9100
- C:\Windows\System\BHHRFWc.exe
  C:\Windows\System\BHHRFWc.exe
  2⤵
  PID:7132
- C:\Windows\System\SUSWUCL.exe
  C:\Windows\System\SUSWUCL.exe
  2⤵
  PID:7524
- C:\Windows\System\hycgARe.exe
  C:\Windows\System\hycgARe.exe
  2⤵
  PID:6676
- C:\Windows\System\wHDVcXg.exe
  C:\Windows\System\wHDVcXg.exe
  2⤵
  PID:2664
- C:\Windows\System\QuAPpFY.exe
  C:\Windows\System\QuAPpFY.exe
  2⤵
  PID:10460
- C:\Windows\System\rDwjNOJ.exe
  C:\Windows\System\rDwjNOJ.exe
  2⤵
  PID:8608
- C:\Windows\System\wbLztRq.exe
  C:\Windows\System\wbLztRq.exe
  2⤵
  PID:10588
- C:\Windows\System\JPCaRAT.exe
  C:\Windows\System\JPCaRAT.exe
  2⤵
  PID:10628
- C:\Windows\System\ixQcMSq.exe
  C:\Windows\System\ixQcMSq.exe
  2⤵
  PID:9468
- C:\Windows\System\degVYCm.exe
  C:\Windows\System\degVYCm.exe
  2⤵
  PID:9524
- C:\Windows\System\ZkgYiMa.exe
  C:\Windows\System\ZkgYiMa.exe
  2⤵
  PID:10900
- C:\Windows\System\EICngHE.exe
  C:\Windows\System\EICngHE.exe
  2⤵
  PID:9576
- C:\Windows\System\tvekVPQ.exe
  C:\Windows\System\tvekVPQ.exe
  2⤵
  PID:8812
- C:\Windows\System\NLuARnA.exe
  C:\Windows\System\NLuARnA.exe
  2⤵
  PID:8820
- C:\Windows\System\EHXkUOx.exe
  C:\Windows\System\EHXkUOx.exe
  2⤵
  PID:8864
- C:\Windows\System\ICFoWJG.exe
  C:\Windows\System\ICFoWJG.exe
  2⤵
  PID:10232
- C:\Windows\System\TWrCuEe.exe
  C:\Windows\System\TWrCuEe.exe
  2⤵
  PID:8568
- C:\Windows\System\YmvbOHo.exe
  C:\Windows\System\YmvbOHo.exe
  2⤵
  PID:7768
- C:\Windows\System\vtSectR.exe
  C:\Windows\System\vtSectR.exe
  2⤵
  PID:3612
- C:\Windows\System\TRdDhRr.exe
  C:\Windows\System\TRdDhRr.exe
  2⤵
  PID:9144
- C:\Windows\System\MGaoXDq.exe
  C:\Windows\System\MGaoXDq.exe
  2⤵
  PID:5176
- C:\Windows\System\vIyAYJu.exe
  C:\Windows\System\vIyAYJu.exe
  2⤵
  PID:5900
- C:\Windows\System\tApWBfI.exe
  C:\Windows\System\tApWBfI.exe
  2⤵
  PID:7100
- C:\Windows\System\ZpDcptZ.exe
  C:\Windows\System\ZpDcptZ.exe
  2⤵
  PID:8148
- C:\Windows\System\qRabDZy.exe
  C:\Windows\System\qRabDZy.exe
  2⤵
  PID:5632
- C:\Windows\System\pAMCVUy.exe
  C:\Windows\System\pAMCVUy.exe
  2⤵
  PID:3624
- C:\Windows\System\YYBYfls.exe
  C:\Windows\System\YYBYfls.exe
  2⤵
  PID:6384
- C:\Windows\System\wWNDRcR.exe
  C:\Windows\System\wWNDRcR.exe
  2⤵
  PID:3508
- C:\Windows\System\ywdMIvv.exe
  C:\Windows\System\ywdMIvv.exe
  2⤵
  PID:12292
- C:\Windows\System\ujNILzZ.exe
  C:\Windows\System\ujNILzZ.exe
  2⤵
  PID:12316
- C:\Windows\System\pHFzbkw.exe
  C:\Windows\System\pHFzbkw.exe
  2⤵
  PID:12340
- C:\Windows\System\jiCjlhE.exe
  C:\Windows\System\jiCjlhE.exe
  2⤵
  PID:12364
- C:\Windows\System\wfPvLli.exe
  C:\Windows\System\wfPvLli.exe
  2⤵
  PID:12380
- C:\Windows\System\aHPXDyi.exe
  C:\Windows\System\aHPXDyi.exe
  2⤵
  PID:12408
- C:\Windows\System\XPVMzKo.exe
  C:\Windows\System\XPVMzKo.exe
  2⤵
  PID:12432
- C:\Windows\System\nCVjbSO.exe
  C:\Windows\System\nCVjbSO.exe
  2⤵
  PID:12448
- C:\Windows\System\aWGXOrB.exe
  C:\Windows\System\aWGXOrB.exe
  2⤵
  PID:12476
- C:\Windows\System\LTWYzOX.exe
  C:\Windows\System\LTWYzOX.exe
  2⤵
  PID:12500
- C:\Windows\System\CyeKfVy.exe
  C:\Windows\System\CyeKfVy.exe
  2⤵
  PID:12524
- C:\Windows\System\OVsFXCS.exe
  C:\Windows\System\OVsFXCS.exe
  2⤵
  PID:12544
- C:\Windows\System\EjpjPxV.exe
  C:\Windows\System\EjpjPxV.exe
  2⤵
  PID:12568
- C:\Windows\System\VgAkIkh.exe
  C:\Windows\System\VgAkIkh.exe
  2⤵
  PID:12592
- C:\Windows\System\xNtkMVG.exe
  C:\Windows\System\xNtkMVG.exe
  2⤵
  PID:12616
- C:\Windows\System\gcPVutc.exe
  C:\Windows\System\gcPVutc.exe
  2⤵
  PID:12636
- C:\Windows\System\fcOODtd.exe
  C:\Windows\System\fcOODtd.exe
  2⤵
  PID:12660
- C:\Windows\System\DknMiJg.exe
  C:\Windows\System\DknMiJg.exe
  2⤵
  PID:12680
- C:\Windows\System\XOmMkkY.exe
  C:\Windows\System\XOmMkkY.exe
  2⤵
  PID:12704
- C:\Windows\System\ZEGHwHC.exe
  C:\Windows\System\ZEGHwHC.exe
  2⤵
  PID:12724
- C:\Windows\System\ACLETKb.exe
  C:\Windows\System\ACLETKb.exe
  2⤵
  PID:12748
- C:\Windows\System\ByhivHe.exe
  C:\Windows\System\ByhivHe.exe
  2⤵
  PID:12764
- C:\Windows\System\juIcduz.exe
  C:\Windows\System\juIcduz.exe
  2⤵
  PID:12788
- C:\Windows\System\uYBIIQZ.exe
  C:\Windows\System\uYBIIQZ.exe
  2⤵
  PID:12812
- C:\Windows\System\VMPfcGV.exe
  C:\Windows\System\VMPfcGV.exe
  2⤵
  PID:12832
- C:\Windows\System\rxOheCA.exe
  C:\Windows\System\rxOheCA.exe
  2⤵
  PID:12852
- C:\Windows\System\eUsoKHu.exe
  C:\Windows\System\eUsoKHu.exe
  2⤵
  PID:12876
- C:\Windows\System\YLjxeTJ.exe
  C:\Windows\System\YLjxeTJ.exe
  2⤵
  PID:12900
- C:\Windows\System\NciCnze.exe
  C:\Windows\System\NciCnze.exe
  2⤵
  PID:12924
- C:\Windows\System\NwMIpzX.exe
  C:\Windows\System\NwMIpzX.exe
  2⤵
  PID:12940
- C:\Windows\System\YNpedWO.exe
  C:\Windows\System\YNpedWO.exe
  2⤵
  PID:12964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_120d2uyo.n04.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AHvQsHe.exe

Filesize
1.8MB

MD5
91827b1068fbb13e3c9ea5687512485b

SHA1
df3091be475701b4256bb654e48de2a16ae79b8f

SHA256
9270534f5b834ee86257e6e13a94dfa65e2b69e8deeef6fd5204c06845e5d47b

SHA512
971d035f574b3aab88c409c7030175cbf7bc277933c46f39ea3551101fc285799221bea1a79ae65db9e928860c4db9f6d3adf98ac08b85c149f250a4f6111b2a

Download Submit
C:\Windows\System\BaAuSaC.exe

Filesize
1.8MB

MD5
d038d20b401fdf78d0d6125d2b241ab9

SHA1
33b9481c1f796a8fc5d65a927bf0548f97ccb349

SHA256
32515fdbb6482d50c2070f43bb8f1d5443aeafe02e0c490a4be73efb50c9bd57

SHA512
572093e9e223c8523b21057df89e9cae212f4f69394ae6852936e97ca263a97c2ed2aa67c7b09aa6cf40de3b3d07a9c757bf701abb2ead63664dc88b5faf5d88

Download Submit
C:\Windows\System\BarhRzl.exe

Filesize
1.8MB

MD5
3fc0d8963d8408e18f66b0daf27bb86c

SHA1
5e9c40ebaeb1a7b73a95ac0545bd9bfee25d5b30

SHA256
787e946b64118115f8167fb95955c8a3587087ca6f724322b6b0f247bbdfdb58

SHA512
9f80604b38cdf0cb09e0f13802d01ab5ea8edfc657bff93fe4c2db5bf6a5f62ab63d96f3116ceb77cdab9fce8cf358cabcf104f41643505e8889b91faaffe422

Download Submit
C:\Windows\System\FyxHqqq.exe

Filesize
1.8MB

MD5
c9dd4ef9b4dcff9b42a4e139f0e53708

SHA1
74033aed3428daa0b86180b706ea790dbe2d059d

SHA256
5b7932a8e72faf06d654e949ca91ffecca785f57c146f3cb114f26f345788c9b

SHA512
15377fe0cde38f2270df1aa1cd6c155f623f9356326d68fa270c9171f0f8e13d0c20961d5034984f9512826c7d561a2b1682b4a6b1c9f85e5a8e005dbdd9b4be

Download Submit
C:\Windows\System\HitQoKe.exe

Filesize
1.8MB

MD5
cc16dfb15cb3ab1172ce4603b3506582

SHA1
ebd1ec10e2e4e21b2e467e30141cf6b0e1da0564

SHA256
583f7dad2d9a8deeee5cbf4d9ddf26de5063fdd683889c48667595f8dc0b6538

SHA512
7a8a22a5acdc541c29445518f4418f82e9784b5ed3505cd5afab3a1681ee462572ee1dfb924d7f308b263d6f8a6f0dcc9cad2456200fa7fe2fb85f1439cbfbbf

Download Submit
C:\Windows\System\JhmosBp.exe

Filesize
1.8MB

MD5
ea62fe2ac02dfd010152d58e6b525a33

SHA1
dc7ee53a273e3ab92bccb6ab455861808e660939

SHA256
e26ca41f2df85c31ad80738ab73adbe66b6b3ea4a1247c098c981ffb45515499

SHA512
baaf2090c0aca6ee26134d3cf66f41ae9dcecbc9374abc6d792632524aa28ce149535ceb7c8dc786502074b98d334cfd47e5bb975d29ba1fd4926ce818ff17d0

Download Submit
C:\Windows\System\KKWOZVr.exe

Filesize
1.8MB

MD5
74e629e787906dacd086374bd2da98a3

SHA1
d211ecbae6c32fe59579b1188783ef07b8981ead

SHA256
96163cf9c4c8a918b47999f1688b4e89bb6c24e1805fd8092aaa986d06fb97e6

SHA512
7af0f4962e6aa34e5485f8163b75303b2f79bfa238544a02e9afabdd61a34b1c671a04cbdb40b8254b73162b6a92448266a3474ab5ac563ef57ea6c711ca4d35

Download Submit
C:\Windows\System\Ldnioew.exe

Filesize
1.8MB

MD5
5cbcc1bd74994d6f3bc7ca75dd275de8

SHA1
30122f4b5650a8887bddce1af2934015d9faeb4b

SHA256
894bb0a9db16d652e8a848f268abed9d31d53bd517383ff2c88e322cd3454f98

SHA512
133879692e876a70eeae809295a3a757f394f8f026404957676c6e765212f4899427345e1caf439d6cdbe8c0209f132165bf312b51b3821ec65a7eab1f0fe9df

Download Submit
C:\Windows\System\LwGftcN.exe

Filesize
1.8MB

MD5
11dc4fc45cf1801d8c4c53ed469b7912

SHA1
4bf7ba088cbd4937f507e6dce93936a53bddcaea

SHA256
0f4214398640235dd399629ce10d4b125c83feaf6635d39c5dbf806a2451c3a6

SHA512
5fb963c9f1b42e48dc18dfa640ea124dde9f27f26b2793913d9f061e34ec364e2d860574502c17eb25e544535b25a72e5ca58c77f7a675aaf9403384b2fe9811

Download Submit
C:\Windows\System\NuEUSxV.exe

Filesize
1.8MB

MD5
a9c1da75f8a088977ef655ac89bba12e

SHA1
9b992d106306b6e79921ed1562e5f90c0ebea98a

SHA256
4a9c1e774e74483c5e864a789c394402647286fbe5394121c0c331bd48f524e3

SHA512
d415434dd75e900b9ab1bbaea985e95d5c80902dad66513ce19fcb5943cba6187dc3aba2df6d59a740821fd2166efdffb5d48fb0f4113e043dc438b0ddc1f362

Download Submit
C:\Windows\System\OTfmhZt.exe

Filesize
1.8MB

MD5
a07951228f6f206e00106a212fc28285

SHA1
952bf03b41f9984399ade11873e7cd1e5eecde74

SHA256
6fcb942faccd5197875666e13d071d0d516ba73faa914624dfa7127a22520654

SHA512
92ce448863e2fec776938025ee23162467738f7fadafe2b65f7e83d6c285c980e8defe66eac1b6c39f33dfddd1886953d32808b73e06739ff9fad58762abe14a

Download Submit
C:\Windows\System\OUYKgXF.exe

Filesize
1.8MB

MD5
4cbe059c577363fd3d7e0f37e0d3c9c7

SHA1
d5622a3a964a39eb6ae9dde9961874ed5ac0199e

SHA256
b311c8ba2f132021aa4e2c81545534221abdc694be86adc61696650a7b5256bd

SHA512
7754f4c61c3448959cdb23eff45c4ef55f0434cf7130591ee48cdcb9a64f9caff50a35e9e30ec38646311e8581107bf8e60da7e7d5777bb7dc7030c7fd66357b

Download Submit
C:\Windows\System\SWfXFde.exe

Filesize
1.8MB

MD5
a0afa51395631a06d638ff1c7364f65e

SHA1
e2c41063b2adca0d8f8dff64a5a71674cb9d8792

SHA256
233201b07e44826d57a70adbf94e45687495101620f8fb78cfd0265b73555b07

SHA512
b0b8ca47a49ce5db1c2b994b8a15691a74e5157e2bf53a6ab16af7828738b7ccc469fc01a1b6c99071f7b10773fa5736fac0ec53f51c4f6b03b8111cccf1c5e8

Download Submit
C:\Windows\System\SuiQaeM.exe

Filesize
1.8MB

MD5
e6bc4293d3272d7171a68b77986e46fa

SHA1
4f36dea6d683a519bbf1663d2c27bec14619f983

SHA256
471670c8fd3090ca08fabd4eef7efca4c4dc1768ca83c353374dca95b9f017c1

SHA512
7a477d6462538b39c0b0825d81cb2b1037660547a3873ed1f76a70f29a3ca28e319a4ae9a2a5a1d1ff518301324bbd2c77eb764d100d53ab2b3f574f7a838903

Download Submit
C:\Windows\System\TNvQrtF.exe

Filesize
1.8MB

MD5
ff12eaf91afddbbba20be84d59cfdc17

SHA1
a80a5c8e3d2b96775d3494f4a405be5488978141

SHA256
fed6a612bd7255c0bf437d2017720abb779411344a368f02945542fb9598906c

SHA512
ba6fb4e2850cc337767b47694293e1f62cb32ebb3a46e1ace10aff5dd464d3b420d299c5d3dd509aa04d900b42408f2aea52fb9bb8b3c4dac457c92d3148bdc3

Download Submit
C:\Windows\System\TOBziva.exe

Filesize
1.8MB

MD5
51ed5a3f3d3ad02e4629799f9080a583

SHA1
d8deb8b8498fdb10bf3569ac925f170c72438568

SHA256
7be43676672113c533f16ac5f14283393a59812e9743abe9d1f30063b60ad8db

SHA512
116790de0a1dba86af6d53b6c6efe0728153dfee5ffbc6eaca781d19c7eb6e95274924582d3964dd6220cd95840468e182bc8eb8a2a8f99b4d1b2adc9ef574d1

Download Submit
C:\Windows\System\UWluzLx.exe

Filesize
1.8MB

MD5
568c44a604162da0bdab03cc441363a7

SHA1
8d0b56e1d331628e7f5c47b1a82156b1e9005a57

SHA256
5ddf65445049b19cd32b01b47ef11844f5370b0c5e8518cf7712b03a99190f98

SHA512
fbe84fff6751918502561b5ddbf7db02573b7c6ec7303d09198fe9457bf9cf9000e0054609adc1c01cff3af35c22f3cd8629a411eff0eb89dac448d514615852

Download Submit
C:\Windows\System\WDWSjBR.exe

Filesize
1.8MB

MD5
5e628bdb52c90749483e77ee8f52019e

SHA1
426fb45d67cb1b9c3d2b9f3c68ad9eeb7b61eca8

SHA256
b4229d9b42f2098affdb9ba8d48232cb09dfacb7709793e8d1c29ee498d2a2ab

SHA512
39f61d871b1e0ab52e1a3706632cc1365d570433d25d302d8b550e0d417afc8ea553d0184c2f75605d70298107dcc344aef9d58e473a5b34161835766b0d87c1

Download Submit
C:\Windows\System\WWjJFCf.exe

Filesize
1.8MB

MD5
0bc7b5053b2b87fad07290abb54ee9cb

SHA1
1d1e89c5d704f092f2159e05197c3c4a41b495ea

SHA256
9ab46a2ce34d97f2d71749a6ff162a11b5ff67bc7f2d77ab91af0ae8122cc476

SHA512
5fcf57251ee4afa05049315d61a849929c460f072a4906b9121aaa82fb60af5e321ef3c682a6cb23ab9b2c169519b1e64733cfa3ec69b379c4f0dc534a063c87

Download Submit
C:\Windows\System\YmyndXD.exe

Filesize
1.8MB

MD5
f8fb92124ad1db3ee4db8d2a167045b7

SHA1
ea5f980c67c0778e72a7fd862e05226838ae5673

SHA256
a36c3d7c9af4246384b86b815c47ede3c2ef40b94441bc4b16c1e68a5146de82

SHA512
08833f08ffdf1376987a061b7a12f0eafe065e28aa55b11bb3977ef87a1c3f7f8250c2f78a0e9ee98958123fd900f3e5328e285c1a4342f0c1da46aea81560e0

Download Submit
C:\Windows\System\ZBdhTBi.exe

Filesize
1.8MB

MD5
ff10e93fadd963d1fb3cb5cdfd6c7faa

SHA1
2391978c02ed018417fc426a79a9fbea9b6f05bb

SHA256
99d3fd90dc080a39544f76a880bcf60806832ef68935d5c87d8c3e3f4177b534

SHA512
e9e317e8ec6fbaa11c4d33f435702f88d31089be9d6b7e451469a193ab7f041063e52c271c3dfedb4c1c7bd4c2a6e3a05dd0bf11b92a6b3c1cfae24997f5ea44

Download Submit
C:\Windows\System\aqCBsor.exe

Filesize
1.8MB

MD5
d490992d759828e6d6916f92cf4ad1ef

SHA1
08cf0b339a907faba7f1a15ad69eb6dfe4366587

SHA256
a0a0f570ee6095089e9a740c6d6c6462eafe221d87e1d2072d442582b7ba4994

SHA512
d8261e2184e66a74e9972bd045df6d7158dedd9b659defabfd9caff1ae531111c874ce1a830d4239435620fe695ff0be90153ee6c8ac725d6f01701684a4bf13

Download Submit
C:\Windows\System\bgAEfEc.exe

Filesize
1.8MB

MD5
b1e32da27009280409031115ad8fdd88

SHA1
5df443ba1f71ce3dc74f96a5c5de5a39809e0ba1

SHA256
311a8d601edf29870fc35fe924660878e83fc9f519b96dd93e1438cacafe8acb

SHA512
90143a2527e5a697d63a361c6945632796af222530f76963083c776887d2f65f73cc88b00a1ba13f9075caca4415f71f9cfe9fd12570a6d7a3cb2ea5b2aa6840

Download Submit
C:\Windows\System\cGCBExH.exe

Filesize
1.8MB

MD5
1930dfd48cf65acd5e40c6bc13d38a01

SHA1
c7bbbe44da4c563ed99fac04743292ed5e9566cd

SHA256
80f5d49d948fc4f9415a5abece54d6854615daaae8e71e791dcab8caa8186836

SHA512
0a78ca064327530b5532e8658f806b99a2f63e768d699c9d87aff4bbf7e9af3aa5572ae13946df3bf47024024a09aa7acc45f4d7cded24b306c586459b875cc2

Download Submit
C:\Windows\System\cKGbKwh.exe

Filesize
1.8MB

MD5
b66f06909fd52861986f0b44ec92f92b

SHA1
06305a537b4b8028f1241fdc9524c706e8f4f354

SHA256
60aee612c920c652b716ff14b637b64222762dc65cef901d783dc1afe875c4e2

SHA512
93309486daf940784f8ed1d89b9603b62f498f9691d8a0ed45a5c2fe8416d5edb7dcf57e24e031b855391d881d672c2b4cb78e9b98f7fbe0d3cd5c49d1f9eaf5

Download Submit
C:\Windows\System\dTxAbKn.exe

Filesize
1.8MB

MD5
4ba64f4056112c4042b557e5489db89c

SHA1
854aa1c4001bfdf102f1070e70ac3201515ecaf2

SHA256
655b07ae8f33d9aff86d15f9f7d11c28fd8b6a6c005b6cc101da2a3f9dfbc5c7

SHA512
c7d431d61fa4385420de14cc2f6144fdc6c1273eac8dc0906c5d3d3769108eb9df281080343c082a00247884af84a14df79f08f5dc155ffb878f67a98587113c

Download Submit
C:\Windows\System\diVcgIt.exe

Filesize
1.8MB

MD5
f7095c22b8c37d401057b9e34d70254a

SHA1
66c6523c6e53f702f77d479c3753637d7513da53

SHA256
861ad1cfde3c9ea227dd4766575d333f546e8708cf3272b5e5cfa65e2110d661

SHA512
383aa35a5a9c7b01ad15fd097e35df4e5ba2790e5a17d324456da39ad9cb2678c9cc565f1700aa80fb565e6807417b603553f35378f31e6550ed8a6f69b66cad

Download Submit
C:\Windows\System\diWJRJr.exe

Filesize
1.8MB

MD5
a300542ab82e3fa33990b199723008f4

SHA1
563793ef22ee770d6087ff4d2846fc9ea7d7dfe4

SHA256
00ea7a921481222643a6e95712aba0ec6d20a53ca6134f3e28eaf89d210d3b5d

SHA512
dd64717d3089ea65445232a550a1d5b3225128b28b389e1a4127645b37addf6488fa5647bc4e71105b3f626bc2658c4934a0760b3a7341d447fa057cb5cc2553

Download Submit
C:\Windows\System\fHRiCFG.exe

Filesize
1.8MB

MD5
e3905f0952f5a1b4de1d50280b35340f

SHA1
c5599450e2faf14fbcdb6350573f24b406f98e68

SHA256
37ce5c1f6b67889fea4888323cbe7a2750ff6af2b07a7c04b4a93065a3d466ae

SHA512
ec21dfc26d40e7901b1f7a5c610b6594df32a10e77b75107b9f148acc1817bcd729b032c9308db6e7fe97a3383d246e522521510965c98eccad7d5cd016f9590

Download Submit
C:\Windows\System\fNzUeCV.exe

Filesize
1.8MB

MD5
d588a0f88e881396b2311dd196360811

SHA1
cb395a398afa9fbc2bef6409344ecd9d9ab4f3e0

SHA256
efd69d320b9269bac2b85f40beb83a001340b26f460c87777643d7b8ff83eed7

SHA512
b45f08fea8d9c0dce4dea7e05fc95c0a97ca61e807661ca4d4144e588bdb79b079ae1ab98131b5d8f1544ef56a910e6223d53f0cdc5f0e0b3acbc9912773914f

Download Submit
C:\Windows\System\gBbNyHB.exe

Filesize
1.8MB

MD5
6fcce001f545cc19b0c16ff8ca106dc1

SHA1
afc6dd7d88b05a1b8fa18480f6253a55996b26c7

SHA256
c4c12ef459fc751d8086d4c604700986780ffc2a5660777de1c1e576c038e67d

SHA512
11db708bd3063cef30cc7900fee34204934339b8138cbb7dd94d121484214ca6bdab220b8955dd1f55595200371a5b8a72c23150d1e0d83b4dfac392c2d74ab1

Download Submit
C:\Windows\System\hIfBcXD.exe

Filesize
1.8MB

MD5
75b8cff69d4d0369413d98e9526ed5bd

SHA1
9373b5b21051434aca99bf9e8f5a4d54821eeca2

SHA256
ed2032959762e7ba4d19d05464bef2c68ee3b45ad4b8f46d306764569701b06e

SHA512
aaefc7b05c5c1f4739aa8a3f8020aa3b85289c941d10e784483c5b08397a2994f935d19095ec80807c8d8e8dc3be778e77fcc485baf458df0c5dc479dfd704b4

Download Submit
C:\Windows\System\hhGKFuc.exe

Filesize
1.8MB

MD5
889076740eef9cb27a023f3b52784db0

SHA1
4e14dda4273fd5c995b6bca853426267c9c18109

SHA256
65c928e81acd6a3d5cf3574325502344998f72954939a4f59300564e3482c75b

SHA512
f00286a589845406e33729d7a64db52d47c9967df404f188960643508c79c2846d0c0a433e49e15a1c237bd2c850b95322a82a2d623d1e823416250dddfc6d13

Download Submit
C:\Windows\System\lTIqove.exe

Filesize
1.8MB

MD5
d5b6c25bd5b37c0d2fcc221206bbbe56

SHA1
ee5bd701b4663131821754639472931a7b036d26

SHA256
b8e53ffaffa54101c158dcc60bf16ca8f5f97f49fbe4b4bf9a1dd43e2b093ec4

SHA512
732f847e43635ce69927b7feb9dc4671a2ed5f44d02c90b232033323c90929e89868d352ead2ac4125b72ee574d6a717c5120647435cd49222d8639b1f71c4ce

Download Submit
C:\Windows\System\nxOxsqw.exe

Filesize
1.8MB

MD5
27be79964c7cd3f3187c5299b2fb2a8d

SHA1
6ef702e496d64ad3e6328ebac4be896b4750bedb

SHA256
b3785c5d93c4c3cc9403443819109853dd5212c85e9b3765d822f88ec81376f0

SHA512
c32517550f4b883c3e853ace2afe38c96f1729132a5af5286f8dc2848018bfefdb830ab521bbb8a0e2e0789a3cf7de2379a392681ba428a75ed8a873daad713a

Download Submit
C:\Windows\System\oKACRbX.exe

Filesize
1.8MB

MD5
1b544b6af1a1fa888f332e2235d152a1

SHA1
e6b3f50d12157705cc13e38f65f024e302bd3709

SHA256
1bb692fc778efd6a583cac43b40682cd051c86d3ae225e6837c247f30713de56

SHA512
9bfe565828dd583add75aecb68590209013243cd2e075ce8da5417d02c3ac10932423d0afc3b99993a4c17cbe8e79487ce729e0f5ef7fdb18c4566aa7ba5e64c

Download Submit
C:\Windows\System\syhxDsf.exe

Filesize
1.8MB

MD5
36ea4e5491a74580e7e8e1f5d6883fc6

SHA1
07846aa7d6b5a1fbfc6e831bbc53767bd0511fcb

SHA256
3f9e7b4afabdf5c268bc93254f23ef828c0a99ec588ee0a10a8397d4972df0ab

SHA512
6bd577c7ebde2ee6f139347bf0b7a7eb1d91c58ebdd6a21dce97a5d7756357d3151a86b57f8285efe2bae1c4537456b615ff77b5f718785f6288a247bfe38456

Download Submit
C:\Windows\System\xgAdWKD.exe

Filesize
1.8MB

MD5
7e9fecf9729d35d0411efea6b128a5c5

SHA1
4c01c852de5211cd7bee077afb3d44f22dfbf9fa

SHA256
1621f8a44889f12b51fccf075ba605d849d5134b3a744d11ed24f750ca8fce5a

SHA512
63d45a7fe1f9b6c033d694c76ab0131274fb2f80fb61db63cf718f26798dab20ebc1ebc76c19cbc6e5298d8b996560118705a717db2b652c711d4b8a465e8859

Download Submit
C:\Windows\System\zOHLqme.exe

Filesize
1.8MB

MD5
6247383da7b9eb8fbfb1e55145c766fe

SHA1
4aca019255be3f0bf115498c2d5b0ef4f27de2de

SHA256
3ee0e5e8bac8ab09a09242d189a3cc8aaa2c20ee953ad810397e69d0c89c1e92

SHA512
42b63e233601dd137b82c6d90cac0eceda9261ce740f370ecba76d9556dc49c56ff6a451512e9c71a1bd223f40d3709eac3da17748f4592b74d08c88767490c6

Download Submit
C:\Windows\System\zqFywgA.exe

Filesize
1.8MB

MD5
6ee2ba0f5c00cfaaa569080c0e5acaa7

SHA1
a938d913be067b6c2f283dea629df2ffdf53a9cd

SHA256
ada52437d977f7029aa572c6ec6a0e153738463cc5845aee3da1385621052384

SHA512
0e750bd129438ae0d2a984b81a3c60491f29cf7ee2d176972555a19a063f9e7258d6e12e7ca357560cc3d27516006efe261c77106ff517b40255e4a2a765ff53

Download Submit
memory/396-2155-0x00007FF7AB0C0000-0x00007FF7AB4B2000-memory.dmp

Filesize
3.9MB

Download
memory/396-229-0x00007FF7AB0C0000-0x00007FF7AB4B2000-memory.dmp

Filesize
3.9MB

Download
memory/980-2152-0x00007FF6A54C0000-0x00007FF6A58B2000-memory.dmp

Filesize
3.9MB

Download
memory/980-569-0x00007FF6A54C0000-0x00007FF6A58B2000-memory.dmp

Filesize
3.9MB

Download
memory/1088-2183-0x00007FF69AAA0000-0x00007FF69AE92000-memory.dmp

Filesize
3.9MB

Download
memory/1088-571-0x00007FF69AAA0000-0x00007FF69AE92000-memory.dmp

Filesize
3.9MB

Download
memory/1200-576-0x00007FF63E4A0000-0x00007FF63E892000-memory.dmp

Filesize
3.9MB

Download
memory/1200-2197-0x00007FF63E4A0000-0x00007FF63E892000-memory.dmp

Filesize
3.9MB

Download
memory/1240-496-0x00007FF66F850000-0x00007FF66FC42000-memory.dmp

Filesize
3.9MB

Download
memory/1240-2173-0x00007FF66F850000-0x00007FF66FC42000-memory.dmp

Filesize
3.9MB

Download
memory/1328-578-0x00007FF73C500000-0x00007FF73C8F2000-memory.dmp

Filesize
3.9MB

Download
memory/1328-2171-0x00007FF73C500000-0x00007FF73C8F2000-memory.dmp

Filesize
3.9MB

Download
memory/1428-169-0x00007FF711170000-0x00007FF711562000-memory.dmp

Filesize
3.9MB

Download
memory/1428-2148-0x00007FF711170000-0x00007FF711562000-memory.dmp

Filesize
3.9MB

Download
memory/1880-2164-0x00007FF6838B0000-0x00007FF683CA2000-memory.dmp

Filesize
3.9MB

Download
memory/1880-497-0x00007FF6838B0000-0x00007FF683CA2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-2188-0x00007FF75E280000-0x00007FF75E672000-memory.dmp

Filesize
3.9MB

Download
memory/2180-575-0x00007FF75E280000-0x00007FF75E672000-memory.dmp

Filesize
3.9MB

Download
memory/2204-579-0x00007FF7F6B30000-0x00007FF7F6F22000-memory.dmp

Filesize
3.9MB

Download
memory/2204-2181-0x00007FF7F6B30000-0x00007FF7F6F22000-memory.dmp

Filesize
3.9MB

Download
memory/2220-2158-0x00007FF64FE00000-0x00007FF6501F2000-memory.dmp

Filesize
3.9MB

Download
memory/2220-283-0x00007FF64FE00000-0x00007FF6501F2000-memory.dmp

Filesize
3.9MB

Download
memory/2348-580-0x00007FF7582D0000-0x00007FF7586C2000-memory.dmp

Filesize
3.9MB

Download
memory/2348-2146-0x00007FF7582D0000-0x00007FF7586C2000-memory.dmp

Filesize
3.9MB

Download
memory/2472-2161-0x00007FF6C66C0000-0x00007FF6C6AB2000-memory.dmp

Filesize
3.9MB

Download
memory/2472-409-0x00007FF6C66C0000-0x00007FF6C6AB2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-572-0x00007FF667220000-0x00007FF667612000-memory.dmp

Filesize
3.9MB

Download
memory/2868-2179-0x00007FF667220000-0x00007FF667612000-memory.dmp

Filesize
3.9MB

Download
memory/3032-2162-0x00007FF650A00000-0x00007FF650DF2000-memory.dmp

Filesize
3.9MB

Download
memory/3032-284-0x00007FF650A00000-0x00007FF650DF2000-memory.dmp

Filesize
3.9MB

Download
memory/3136-2178-0x00007FF73C4C0000-0x00007FF73C8B2000-memory.dmp

Filesize
3.9MB

Download
memory/3136-336-0x00007FF73C4C0000-0x00007FF73C8B2000-memory.dmp

Filesize
3.9MB

Download
memory/3452-574-0x00007FF687670000-0x00007FF687A62000-memory.dmp

Filesize
3.9MB

Download
memory/3452-2175-0x00007FF687670000-0x00007FF687A62000-memory.dmp

Filesize
3.9MB

Download
memory/3476-2144-0x00007FF6AF7E0000-0x00007FF6AFBD2000-memory.dmp

Filesize
3.9MB

Download
memory/3476-166-0x00007FF6AF7E0000-0x00007FF6AFBD2000-memory.dmp

Filesize
3.9MB

Download
memory/3784-209-0x00007FF7850F0000-0x00007FF7854E2000-memory.dmp

Filesize
3.9MB

Download
memory/3784-2150-0x00007FF7850F0000-0x00007FF7854E2000-memory.dmp

Filesize
3.9MB

Download
memory/4232-577-0x00007FF782630000-0x00007FF782A22000-memory.dmp

Filesize
3.9MB

Download
memory/4232-2166-0x00007FF782630000-0x00007FF782A22000-memory.dmp

Filesize
3.9MB

Download
memory/4424-1725-0x00007FF7FBD30000-0x00007FF7FC122000-memory.dmp

Filesize
3.9MB

Download
memory/4424-0-0x00007FF7FBD30000-0x00007FF7FC122000-memory.dmp

Filesize
3.9MB

Download
memory/4424-1-0x00000166A5F10000-0x00000166A5F20000-memory.dmp

Filesize
64KB

Download
memory/4528-573-0x00007FF64ECC0000-0x00007FF64F0B2000-memory.dmp

Filesize
3.9MB

Download
memory/4528-2186-0x00007FF64ECC0000-0x00007FF64F0B2000-memory.dmp

Filesize
3.9MB

Download
memory/4660-108-0x00007FFEFDD50000-0x00007FFEFE811000-memory.dmp

Filesize
10.8MB

Download
memory/4660-37-0x00007FFEFDD50000-0x00007FFEFE811000-memory.dmp

Filesize
10.8MB

Download
memory/4660-2128-0x00007FFEFDD53000-0x00007FFEFDD55000-memory.dmp

Filesize
8KB

Download
memory/4660-2118-0x00007FFEFDD50000-0x00007FFEFE811000-memory.dmp

Filesize
10.8MB

Download
memory/4660-7-0x00007FFEFDD53000-0x00007FFEFDD55000-memory.dmp

Filesize
8KB

Download
memory/4660-1785-0x000001EC3A460000-0x000001EC3AC06000-memory.dmp

Filesize
7.6MB

Download
memory/4660-196-0x000001EC397F0000-0x000001EC39812000-memory.dmp

Filesize
136KB

Download
memory/4928-582-0x00007FF6C7F20000-0x00007FF6C8312000-memory.dmp

Filesize
3.9MB

Download
memory/4928-2192-0x00007FF6C7F20000-0x00007FF6C8312000-memory.dmp

Filesize
3.9MB

Download
memory/4964-2169-0x00007FF65A7F0000-0x00007FF65ABE2000-memory.dmp

Filesize
3.9MB

Download
memory/4964-581-0x00007FF65A7F0000-0x00007FF65ABE2000-memory.dmp

Filesize
3.9MB

Download
memory/5028-2156-0x00007FF7D0700000-0x00007FF7D0AF2000-memory.dmp

Filesize
3.9MB

Download
memory/5028-570-0x00007FF7D0700000-0x00007FF7D0AF2000-memory.dmp

Filesize
3.9MB

Download